W32/Israz Worm

 Information about the W32/Israz Worm:

W32/Israz is an email worm. This worm will infect Windows systems. This worm also possess virus characteristics. The worm spreads through email, shared network drives, IRC and KaZaA P2P software.

The worm arrives with the infected email having the from address as any one of the following;

update@microsoft.com
help@google.com
copyright@yahoo-inc.com

The subject of the infected mail will be any one of the following;

You must to see that
Yahoo FAQ
Windows Update
Update Your ToolBar
Support for Search
Auto Search Wizard

The body of the mail will be from any one of the following sets:

Set 1:

For more information go to Google home page
http://www.google.com

Set 2:

Your file is attached to message. For more information go to Windows Update http://windowsupdate.microsoft.com

Set 3:

For more information go to Yahoo home page
http://www.yahoo.com

The infected attachment will have any one of the following names;

wizard.exe
update.exe
toolbar.exe
support.exe
q322593.exe
fun.exe
faq.exe

Upon execution of infected attachment, the worm drops following files to Windows/System folder;

ossmtp.dll
vUser.exe
vShell.exe
Win32.exe

Also it drops following files to the Windows/Temp folder;

wizard.exe
update.exe
toolbar.exe
support.exe
q322593.exe
fun.exe
faq.exe

After this the worm collects email addresses from infected system's Windows address book and propagates itself.

The worm makes necessary changes to the registry at the following location to load itself at the next system startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also alters the registry at the following location to execute vShell.exe everytime a text file is opened.

HKEY_CLASSES_ROOT\txtfile\shell\open\command

The worm attempts to find the KaZaA P2P shared folder on the network and tries to copy itself as;

Doom_3 Crack.exe
GTA Vice City Crack.exe
NAV_2003 Crack.exe
OfficeXP Keys.exe
XP Keys.exe

The worm has a payload of disabling an antivirus software. Also it tries to locate .URL files in the infected system and alters it with any one the following;

http://www.msn.co.il/
http://www.nana.co.il/
http://www.tapuz.co.il/
http://www.walla.co.il/
http://www.ynet.co.il/

This worm first appeared on 7th July 2003.

 Other names of W32/Israz worm :

This worm is also known as Israz, WORM_ISRAZ.A, W32/Akosw.A@mm