W32.Hotmatom is a new worm that uses Hotmail to spread itself. When downloaded it installs in your computer, running every time Windows starts. Then it monitors your browser (only Internet Explorer) and when you send a new email to someone the worm adds a signature to the email, pointing to a web page with a copy of it which will be downloaded if the user accesses it.
The signature is chosen between one of these:
- Hola, feliz dia de san valentin te hice una postal, descargala de aqui [http://]romanticsletters.miarroba.com
- Hi, Happy San Valentin Day Download you Postcards from [http://]romanticsletters.miarroba.com
- i want show you something,[http://]romanticsletters.miarroba.com
- oye hasme un favor sip porfa, esque hice una postal para alguien pero quiero ver si se ve, ayudame, de aqui la descargas, yo la puedo ver pero puess quiero ver si se ve en otro lado, [http://]www.romanticsletters.miarroba.com ,me dices ok?
The worm also deletes files from disks A and C, overwriting them with its code. Looks like all the webpages linked don’t work anymore, but there could be other variants with different links.
As always, the recommendation is not to open any link received in an email and have a good and updated antivirus.
From | BlogAntivirus.
0 Responses to “Worm that spreads via Hotmail”