Threat Description

Enemany

Details

Aliases: Enemany, I-Worm.Alcaul.r, W32/Enemany, Win32.Enemany
Category: Malware
Type: Worm
Platform: W32

Summary



Enemany is a family of simple e-mail worms created my Energy. By the time of the creation of this description 4 variants were known. All 4 variants are packed with UPX file compressor and are written in Visual Basic. These worms have no payload.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details




Variant:Enemany.A

This variant is intended as it has a bug that prevents it from sending its file attached to an e-mail. When the worm is run, it shows a fake error message and installs itself to system 3 times:

	C:\WINDOWS\Xerox-Update.Exe
	C:\WINDOWS\SYSTEM\Ati.scr
	C:\WINDOWS\Start Menu\Programs\StartUp\WinUpdate.exe

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	The New Xerox Update for our WinXP

Body:

	Dear,
	Microsoft WinXP User, here are the last Update from Xerox Security System,
	please install this file and going to www.microsoft.com and finished this Update too.

The attachment name should have been 'Xerox-Update.Exe', but the worm tries to attach 'Xerox-Update.exe.exe' file instead and as this file is not found, the worm fails to send itself out.


Variant:Enemany.B

When the worm is run it installs itself to system a 2 times:

	C:\WINDOWS\Esel_Update.Exe
	C:\WINDOWS\SYSTEM\Edonkey.scr

Then the worm creates a startup key for its installed file 'C:\WINDOWS\Esel_Update.Exe' in System Registry:

	\Software\Microsoft\Windows\CurrentVersion\RunServices

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	Edonkey Update

Body:

	Hello Edonkey User,
	this is the Update tool, to fix our Edonkey Client to 35.16.61

Attachment:

	Esel_Update.exe


Variant:Enemany.C

The Enemany.C variant has p-code instead of executable code in its body. When the worm is run it installs itself to system a 2 times:

	C:\WINDOWS\teuro.Exe
        C:\WINDOWS\SYSTEM\Aspi32.scr

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	Alle gegen den TEuro

Body:

	Sieh Dir mal Die Tabelle an,
	mit den neusten Information uber den teuren T-Euro

Attachment:

	teuro.exe


Variant:Enemany.D

The Enemany.D variant is actually not a new variant. It's the bugfixed Enamany.A variant - the mass-mailing routine now works. See Enemany.A variant description for more info.





Technical Details: Alexey Podrezov; F-Secure Corp.; June 6th, 2002


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More