Win32/Shatrix.A Worm

 Information about the Win32/Shatrix.A worm:

Win32/Shatrix is a mass mailing email worm. This worm will infect Windows systems. Shatrix spreads through MS-Outlook. The worm mails itself to all the recepients in infected users address book.

The worm arrives with the subject:

FW:Shake a little

The body of the message reads:

Hi !
This will shake your world :-)

Regards,

Infected email carries an attachment called Shake.exe. When the attachment is executed, the window moves randomly around the screen. It copies itself to Windows System directory as an executable file with a random filename. After this it creates a Registry entry at the following location to load itself each time Windows is restarted.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

The worm then modifies .HTM, .HTML., and .ASP files present under INETPUB\WWWROOT folder. The modified files contains the following strings.

MatriX is out there
MatriX has You...
MatriX is All around You

This worm first appeared on 3rd January 2002.

 Other names of Win32/Shatrix.A worm:

This worm is also known as Shatrix.A, Worm_Shatrix.A, W32.Shatrix.A.