Threat Description

Enemany

Details

Category: Malware
Type: Worm
Platform: W32
Aliases: Enemany, I-Worm.Alcaul.r, W32/Enemany, Win32.Enemany

Summary


Enemany is a family of simple e-mail worms created my Energy. By the time of the creation of this description 4 variants were known. All 4 variants are packed with UPX file compressor and are written in Visual Basic. These worms have no payload.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details



Variant:Enemany.A

This variant is intended as it has a bug that prevents it from sending its file attached to an e-mail. When the worm is run, it shows a fake error message and installs itself to system 3 times:

	C:\WINDOWS\Xerox-Update.Exe 	C:\WINDOWS\SYSTEM\Ati.scr 	C:\WINDOWS\Start Menu\Programs\StartUp\WinUpdate.exe  

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	The New Xerox Update for our WinXP  

Body:

	Dear, 	Microsoft WinXP User, here are the last Update from Xerox Security System, 	please install this file and going to www.microsoft.com and finished this Update too.  

The attachment name should have been 'Xerox-Update.Exe', but the worm tries to attach 'Xerox-Update.exe.exe' file instead and as this file is not found, the worm fails to send itself out.


Variant:Enemany.B

When the worm is run it installs itself to system a 2 times:

	C:\WINDOWS\Esel_Update.Exe 	C:\WINDOWS\SYSTEM\Edonkey.scr  

Then the worm creates a startup key for its installed file 'C:\WINDOWS\Esel_Update.Exe' in System Registry:

	\Software\Microsoft\Windows\CurrentVersion\RunServices  

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	Edonkey Update  

Body:

	Hello Edonkey User, 	this is the Update tool, to fix our Edonkey Client to 35.16.61  

Attachment:

	Esel_Update.exe  

Variant:Enemany.C

The Enemany.C variant has p-code instead of executable code in its body. When the worm is run it installs itself to system a 2 times:

	C:\WINDOWS\teuro.Exe         C:\WINDOWS\SYSTEM\Aspi32.scr  

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	Alle gegen den TEuro  

Body:

	Sieh Dir mal Die Tabelle an, 	mit den neusten Information uber den teuren T-Euro  

Attachment:

	teuro.exe  

Variant:Enemany.D

The Enemany.D variant is actually not a new variant. It's the bugfixed Enamany.A variant - the mass-mailing routine now works. See Enemany.A variant description for more info.





Technical Details:Alexey Podrezov; F-Secure Corp.; June 6th, 2002


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More