W32/Annunci.A Worm

 Information about the W32/Annunci.A Worm:

W32/Annunci.A is a worm. The worm will infect Windows systems and spreads through email.

The worm may arrive as an attachment to a spammed email.

Upon execution of the infected attachment, the worm creates a folder named Winsystema in the Windows System folder and copies itself as Freevideo5.exe in it.

It also copies semail.exe, semail.tpl and target.dat in Windows\$hf_mig$\KB090545 folder after creating it.

The worm modifies registry at the following locations;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winsystem
HKEY_CURRENT_USER\software\freeware\{491A5872-C30F-4E54-8FF1-BF31CC73DC4B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8757D640-6754-4A39-B542-64E04BD74053}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{491A5872-C30F-4E54-8FF1-BF31CC73DC4B}

The worm creates the following lnk files, that link to Freevideo5.exe file present in the Windows System\Winsystema folder;

(Current UserProfile)\Application Data\Microsoft\Internet Explorer\Quick Launch\Night Club - Foto Annunci Video - VM18.lnk
(Current UserProfile)\Desktop\Night Club - Foto Annunci Video - VM18.lnk
(Current UserProfile)\Start Menu\Programs\Night Club - Foto Annunci Video - VM18.lnk

The worm creates a dial-up connection, that is configured to connect to a high-cost number.

It may add the following line to the hosts file, in order to redirect the default search page:

205.214.67.212 auto.search.msn.com

The worm changes the Internet Explorer home page to a web site on the www.videochatgirls.net domain.

The worm executes semail.exe file to gather email addresses from the Outlook address book. It uses semail.tpl as a template to send an email to the gathered email addresses with target.dat as an attachment, which is a copy of itself.

This worm first appeared on October 21, 2006.

 Other names of W32/Annunci.A Worm:

This Worm is also known as W32.Annunci.A@mm.