This worm spreads via the Internet as an attachment to infected messages.
It sends itself to email addresses harvested from the victim machine.
The worm itself is a Windows PE EXE file approximately 30KB in size, packed using MEW. The unpacked file is approximately 168KB in size.
The worm contains a backdoor.
Installation
Once launched, the worm copies itself to the Windows system directory as 'winlogoff.exe'
It then changes the system registry accordingly:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "Explorer.exe winlogoff.exe"
The worm creates a unique identifier "KiPiSx017ZxQ" in order to flag its presence in the system.
Propagation via email
The worm harvests email addresses from the MS Outlook address book. The worm establishes a direct connection to the SMTP server to send itself to these addresses.
Infected messages
Message subject (chosen at random from the list below):
Hello
Hi
love
Re:kiss
Re:Love
Message body (chosen at random from the list below):
Hello baby,this is me screen!
Hello! I love sex, is you?
Hello this is me present! Cool screen. Bye.
I Love You!:)
Your Present! Scrren is me faice:) Bye baby!
Attachment name (chosen at random from the list below):
FACE.SCR
I LOVE YOU.SCR
LOVE.SCR
PRESENT.SCR
SCREEN.SCR
Remote administration
The worm opens TCP port 25 on the victim machine in order to connect to mx1.hotmail.com
Payload
The worm deletes a range of firewall and antivirus applications from victim machines.
Check out if we have free
removal tool for this virus
