Win32.Pibi.A@mm spreads by sending e-mail messages with the worm attached in executable format, by sending itself (in .zip format) to other IRC users and by tricking KaZaA users to download the worm from infected users. It was written in Visual C++ and packed with UPX.
It arrives in an email in one of the following formats: From:
(address of infected user) Subject:Hello Body: You will find all you need in the attachment. Attachment: setup.exe From:email@example.com Subject: Hello Body: You will find all you need in the attachment. Attachment:setup.exe From: "Microsoft" Reply-To:"Microsoft" Subject:Internet Explorer vulnerability patch Body: You will find all you need in the attachment. Attachment:setup.exe
When executed, the worm:
- attempts to terminate the execution of processes that contain the substring "AV"
in the name of one of the modules;
- creates the registry entry HKLM\Software\RedCell\infected
with the value "yes"
- copies itself in the "System"
subfolder of the Windows folder with the name "winsysNNN.exe"
is a random number) and creates the registry entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows task32 sys"
in order for the copy of the worm to be run at Windows start-up;
- copies itself in the KaZaA shared folder with one of the names described above;
- creates a ZIP archive (named "win32sysNNN.zip"
) containing the worm in the "System"
subfolder of the Windows folder, if WinZip is installed, and changes the mIRC "script.ini"
file in order to send the ZIP-compressed virus to other users on the chat server, if mIRC is installed;
- copies the worm body (in Base64 format) in the file "C:\Msbootlog.sys"
; this copy will then be used to create email attachments;
- sends email messages (in the format described above) to addresses found in .HTM
files in the "Temporary Internet Files"
folder; information about the user's email account and SMTP server is read from the registry if possible, otherwise the virus uses a hardcoded email address and SMTP server (firstname.lastname@example.org
); a timer is set to attempt to send emails every 50 seconds;
- displays the following message box:
- if the current date is 15 September, displays this message box too: