| Name: | God Message worm |
| Aliases: | |
| Ports: | 139 |
| Files: | Gmw_v0.1.zip - 9,167 bytes Gmw.vbs - 22,228 bytes Gmw.hta -Godmessage.html - 2ascii.bin - Onz.exe - |
| Created: | |
| Requires: | |
| Actions: | Worm / Remote Access/ Mail trojan / Network trojan / Downloadingtrojan / Virus |
| Based on the God Message ActiveX trojan. Sends one to five mails with an attachement every hour to addresses found in Outlook Express. All .vbs files are replace with Gmw.vbs. All html documents found on shared drives are injected with God Message code keeping the original html content unchanged. The trojan server from The Thing is also installed. | |
| Versions: | 0.1, |
| Registers: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ |
| Notes: | Works on Windows 95, 98, NT and 2000, together with MS Outlook Express. |
| Country: | |
| Program: | Written in Visual Basic Script (VBS). |