W32/Naco.B Worm

 Information about the W32/Naco.B worm:

W32/Naco is an email worm. This worm will infect Windows systems. The worm spreads through email and network. It also contains a backdoor trojan component which allows remote hackers to access the infected computer.

The subject of the infected mail will be any one of the following;

Your Password: jad8aadf08
Young and Dangerous 7
What New in TechTV!
VBCode: Prevent Your Application From Crack
Update: Microsoft Visual Studio .Net
Tired to Search Anonymous SMTP Server?
The ScreenSaver: Wireless Keyboard
TIPs: HOW TO JUMP PC TO PC VIA INTERNET?
Run for your life!
Re: are you married?(1)
Oh, my girl!
Just for Laught!
Great News! Check it out now!
Get Free XXX Web Porn!
FoxNews Reporter: Hello! SARS Issue!
Download WinZip 9.0 Beta
Do you remember me?
Do you happy?
Crack - Download Accerelator Plus 5.3.9
Alert! W32.Anacon.B@mm Worm Has been detected!

The content of the mail will be;

Hello dear,

I'm gonna missed you babe, hope we can see again!

In Love,
Rekcahlem ~<>~ Anacon.

The infected attachment will have any one of the following names;

wars
thing
scan
runtime
hungry
hangup
force
build
anacon
against

When the infected attachment is executed, the worm drops three files;

Mscwinsck.OCX
Anacon.BAT
Naco.EXE

The copies Naco.EXE as Syspoly32.EXE under the Windows System folder. The worm modifies registry at the following location to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm attempts to copy itself under the shared folders of Morpheus, LimeWire, Kazaa, Grokster, Edonkey2000 and BearShare.

The worm can terminate security related softwares. On the triggered date it has a payload of deleting all the files in the C: drive.

This worm first appeared on 27th May 2003.

 Other names of W32/Naco.B worm:

This worm is also known as Naco.B, W32/Naco.b@mm , WORM_NACO.B

Download the FREE Evaluation copy of Protector Plus antivirus software