W32/Rodok Worm

 Information about the W32/Rodok Worm:

W32/Rodak is a worm which spreads via MSN Messenger. This worm will infect Windows systems.

When the worm is executed, it displays a window with Generate and Quit options. On clicking Generate, it displays a key in the display panel to mislead the user into thinking that it is a CD key generator program. After this it sends the following message to all the contacts under MSN Messenger.

Hey!! Could you please check this program for me? :) I made it myself and want people to test it. Its a readme with the program that explains what it does! <Website link> <- There you can download it! give me advices on what to upgrade please!!

The <Website link> specified in the message is no longer active.

On clicking the link, an executable file BR2002.exe is downloaded. The worm also attempts to download two files from the same website and tries to save it as UPDATE35784.EXE and HEHE2397824.EXE, which is a backdoor component, under C: drive root.

The worm tries to find the CD keys that belong to a game, Half-Life, and to an add-on component of the game called Counterstrike.

The worm creates registry entries at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

This worm first appeared on 9th October 2002.

 Other names of W32/Rodok worm:

This worm is also known as W32.HLLW.Henpeck, W32/Fleming.worm, WORM_RODOK.A.