W32/Gibe.F Worm

 Information about the W32/Gibe.F Worm:

W32/Gibe.F is a mass mailing worm. This worm will infect Windows systems. This worm spreads through email, shared network drives, IRC and KaZaA P2P software.

The infected mail arrives with a random 'From' address. In some cases the 'From' address will be from 'Microsoft Program Security Division'. The subject and the body of the infected mail will be of random text. It carries an infected attachment with a .EXE extension.

Upon execution of the infected attachment, the worm copies itself with a random filename in the Windows folder. The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm creates a folder with a random name in Windows temp folder and alters the registry to share this folder in KaZaA, which is a P2P software. It also drops various files with .dbv, .bat, .dat, .mse, .exe and .fnd extensions. It tries to disable some security related software and registry tools.

The worm collects the available email addresses from the infected system and tries to mail itself to these addresses using its own SMTP engine.

This worm first appeared on 18 September 2003.

 Other names of W32/Gibe.F Worm:

This worm is also known as W32/Swen@MM, W32/Gibe.e@MM , W32/Gibe-F.