Congratulations to Ddunk who discovered this Virus; It has been processed by Segosa and myself.

W32.Velkbot.A is a worm with back door capabilities that spreads through MSN Messenger, Yahoo Messenger and AOL Instant Messenger.

quote:

---

Originally posted by Symantec Security Response

When W32.Velkbot.A is executed, it performs the following actions:


Sends the following message to all the MSN Messenger, Yahoo Messenger and AOL Instant Messenger contacts on the compromised computer:

Title: rofl
Body: [domain removed]com/pictures.php /r [email address]

Notes:
If the recipient clicks on the above link, a copy of the worm is downloaded. This file is called [email address].
[email address] is an email address specified by the worm.


Copies itself as %System%\winmsg.exe.

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Adds the value:

"Windows Messenger Messenger" = "winmsg.exe"

to the registry subkeys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

so that W32.Velkbot.A runs every time Windows starts.


Creates a mutex "hedlp32a" to ensure that only one instance of the worm is executed on the computer.


Disables the functionality of the following programs:


Taskmanager
Registry editor


Connects to an IRC server on the afil.canadiangov.info domain and waits for commands from a remote attacker. The remote attacker can perform any of the following actions:


Steals system information
Steals network information
Logs keystrokes
Sends IM message
Downloads a file from internet and executes it

---

as long as dumb people continue to open any old link somebody sends them -_-

Messages that contain ".pif" are blocked, the contact doesn't receive the message...

quote:

---

Originally posted by Damo.W
im safe
i accidentally clicked on a link, but i didnt accept the file inside

is it just me or are the .pif things dissapearing these URL's appearing

---

It (the author) changes everytime, most of these are just miniscule changes of the previous version (like the irc server to connect to).

who knows? it could be one person making a batch, or a whole lot of copycat coders

quote:

---

Originally posted by Fergy
who knows? it could be one person making a batch, or a whole lot of copycat coders

---

MORE VIRUSES thanks for the information...disables regedit urgh these are really starting to piss me off

quote:

---

Originally posted by categan
May i check with u guys? after the last update,my computer hang and restart. From that time onwards,i couldn't use msn. It prompt me to redownload my msn. So i remove from my control panel. Now i tried to redownload it,it download halfway before it prompt me "cannot create directory". So what should i do to redownload my msn?

---

quote:

---

Originally posted by may73alliance
MORE VIRUSES thanks for the information...disables regedit urgh these are really starting to piss me off

---