W32/Gokar.A@mm

Visible Symptoms

• Emails arrive from infected users with an attachment with one of these extensions - .bat, .com, .exe, .pif, .scr - and a size of 14 Kb

Detailed Analysis

• Virus is 32bit, with a size of 14,336 bytes and is compressed
  
  
• When executed, virus copies itself to the Windows folder as "Karen.exe", then modifies the registry to load at Windows startup -

  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
  CurrentVersion\Run\
  Karen = C:\Windows\Karen.exe

• Virus seeks the folder "C:\inetpub\wwwroot\" and if found, writes three files there -

  C:\inetpub\wwwroot\default.htm
  C:\inetpub\wwwroot\redesi.htm
  C:\inetpub\wwwroot\web.exe [copy of the virus]
  
  "default.htm" references "redesi.htm" - this file in turn will attempt to load WEB.EXE if launched

• Virus creates an email message in this format, with varying subject lines and body text -

  Possible subject lines:

  • And I miss you most of all, my darling
  • and there's no need to be scared, you re always on my mind
  • Darling, when did you fall...when was it over ?
  • I can't help this longing, comfort me
  • I like this calm, moments before the storm
  • I will always be with you sometimes black sometimes white
  • If I were God and didn't belive in myself would it be blasphemy
  • It's dark in here, you can feel it all around. The underground.
  • Just one kiss, will make it better. just one kiss, and we will be alright
  • The air will hold you if you try, trust my wings of desire. Glory, Glorified
  • The A-Team VS KnightRider who would win ?
  • The horizons lean forward, offering us space to place new steps of change
  • When autumn leaves start to fall
  • Will you meet me and we'll fly away ?!
  • You just take a giant step, one step higher
    
    
    Possible body texts -
    
    
  • You should like this, it could have been made for you
    speak to you later
    
    
  • Hey
    They say love is blind
    well, the attachment probably proves it
    Pretty good either way though, isn't it ?
    
    
  • Happy Birthday
    Yeah ok, so it's not yours it's mine :)
    still cause for a celebration though, check out the details I attached
    
    
  • This made me laugh
    Got some more stuff

    Possible attachment names, where its name is chosen from this list, and one of these extensions - .bat, .com, .exe, .pif, .scr -

    3tgf
    cgfd2
    fdsc
    ffdasf
    fhjdv
    gfdsf
    glkfh
    hgbv
    jhfxvc
    kujzv
    p0olik
    qesac
    r4354gkjw
    rewfd
    rf43dr
    t54refd
    t6tr
    trevc
    twat
    ut545a
    vgrewu
    weafs
    xw54re
    y343rv
    z3vdf

• Virus modifies SCRIPT.INI for mIRC client installations to send this virus to others when connecting to IRC channels
  
  
• Virus contains this string which is never displayed -

  W32.Karen by Gobo
  happy birthday girl !!!