W32/Pintae.A Worm

 Information about the W32/Pintae.A Worm:

W32/Pintae.A is a mass mailing worm. The worm will infect Windows systems. The worm spreads through email and shared network drives.

The 'From' address of the infected mail will be any one of the following;

Tae@Tae.com
noypi@pinoy.com
viruz@yahoo.com
astig@hotmail.com
vaNNeo@viruz.com
lady_juana_cute@hotmail.com

The 'Subject' of the infected mail will be any one of the following;

CDO.Message
My Documents
FILIPINO'S SECRETS
New Virus Information
TaeTae Virus Information
Philippines Government Top Secret

The 'Body' of the infected mail will be any one of the following;

LYRICS OF BAMBOO AND OTHER BOY BAND
Hi! Look the Attach Document for more details about FILIPINOS...
Please read the attach file for more information about computer virus...
HOY! PINOY AKO! BUO AKING LOOB MAY AGIMAT AKO... FOR MORE LYRICS CHECK THE ATTACH FILE...
The Government of the Philippines revealed the truth. For more information please read the Attach file...
If your computer has been infected by TaeTae Virus. Open the attach file and follow the instruction to remove the virus...

The name of the infected attachment will be any one of the following;

INFO.DOC.exe
DATA.DOC.exe
TAETAE.TXT.exe
README.DOC.exe
DOCUMENT.DOC.exe

Upon execution of the infected attachment, the worm copies itself as AutoRun.bat in the Windows System folder, Exit to DosPrompt.pif in the Windows folder and MSKernell.bat in the User Profile\Start Menu\Programs\Startup.

It also copies itself as Readme.scr in C$ or D$ folder.

The worm creates info.txt in C$ or D$ folder, which contains the user name, computer name, POP3 server, SMTP information and date and time of infection of the infected system.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

To propagate itself, the worm gathers all the available email address from Windows Address book(wab).

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on November 9, 2006.

 Other names of W32/Pintae.A Worm:

This Worm is also known as W32.Pintae.A@mm.