I-Worm.Galil
Galil is a worm virus spreading via the Internet as an attachment to infected emails. The worm consists of several components, all of which are Windows PE EXE files written in Visual Basic.
Worm components:
Main file: "iLLeGaL.exe", size approx. 81KB
Spreading component: "Mplayer.exe", size approx. 14KB when compressed
by UPX, the decompressed size is 37KB
SMTP control: "SMTP.ocx", size approx. 26K when compressed by UPX,
the decompressed size is 90KB
Installing
When the main worm file is run it installs itself and its other components into the system. While installing the worm copies its main file to the Windows system directory under the name "iLLegGaL.exe". The other worm components are installed into the same directory. The "Mplayer.exe" component is then registered in the system registry auto-run key thus:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
iLLeGaL = %SystemDir%\Mplayer.exe
The worm then displays a fake Flash animation and the message:
Sorry !
Looooooooool , thanx fo da time u spent thinkin ov me
Spreading
The worm reads emails from victim computer MS Outlook address books and searches for email addresses in .HTM and .HTML files. To send infected messages the worm uses a direct connection to SMTP servers.
Infected email attributes include:
Subject: Fwd: Crazy illegal sex !
The message body text is randomly selected from a file on the C: drive or is in HTML format and contains text such as:
Note: forwarded message attached.
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
Forwarded Message [ Save to my Yahoo! Briefcase | Download File ]
From: Sara1987@yahoo.com
To: Virgin_gurlz_N_boyz@yahoogroups.com
Date: 24 Aug 2002 17:11:18 -0000
Subject: Fwd: Crazy illegal Sex
Hii
Is it really illegal in da USA?
who knows :P
If u have a weak heart i warn u
DON'T see dis Clip.
e.t.c.
Attachments:
iLLeGal.exe or illegalSex.zip
The worm activates from infected emails only when a user clicks on the attached file. If the attachment file is clicked the worm installs itself to the system and runs its spreading routine and payload.
Payload
The 'Galil' worm creates a new key (counter) in the system registry:
HKLM\iLLeGal
This counter is increased (advanced) each time the worm is run. When the counter reaches '5' the worm deletes all files on the D: E: F: and G: drives and then displays the message:
ZaCker
No Peace Without war,i hate war but im forced to love it,Hidden
Power's gonna b there wherever u r
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
All Trade names and Trade marks
are hereby acknowledged as being the property of the Registered Owners
181202/100904/031004
