Welcome to BrightSite by bright.net Internet Services
Online Signup
Nitro Dial
Web Mail
MyMail

bright.net Anti-Virus Page
Navigation
Recent Entries
Links
Firefox
Virus News

W32/Looksky.E
W32/Looksky.E is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be;

Account # 394875948JNO Wed, 28

The body of the infected mail will be;

Hello,

We sent you an email a while ago, because you now qualify for a much lower rate based on the biggest rate drop in years.

You can now get $756,000 for as little as $909 a month! Bad credit? Doesn't matter, ^low rates are fixed no matter what!

Follow this link to process your application and a 24 hour approval:

http://mainecomputergroup.[blocked]

Best Regards,

Bernadine Guy

The infected attachment will be;

main_23_c.exe

Upon execution of the infected attachment, the worm copies itself as sachostx.exe in the Windows folder.

It also drops the following files in the Windows System folder.;

attrib.ini
sachostc.exe
sachostb.exe
sachostp.exe
sachostw.exe
sachosts.exe
msvcrl.dll

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun

To propagate itself, the worm collects all the available email addresses from the Windows Address Book (WAB) of the infected system.

The worm mails itself to these addresses using its own SMTP engine

This worm first appeared on November 29, 2005.

January 31st, 2006
bright.net does not support nor endorse these programs but have found some of them helpful. Many of the programs and links found on this page are for third-party applications and are to be used at your own risk. Should you encounter problems with the tools, you may need to consult a computer technician for further assistance.