Evaman.A is a simple massmailer. It sends itself in emails appearing to be error messages.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The Evaman.A worm is packed with an unmodified version of UPX. Once extracted its size grows up to 40960 bytes. Once executed it creates a mutex named "MyNameIsEva" to ensure only a single copy of the worm is running.
Upon execution Evaman copies itself files to the Windows System Directory:
%SysDir%\wintasks.exe
'Readme.exe' is added to the registry as:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "wintasks.exe"= %SysDir%\wintasks.exe
to ensure that the worm will be activated when Windows starts.
Evaman has its own SMTP engine. When sending email it will create recipient addresses containing usernames form the following list:
Mike Jennifer David Linda Susan Nancy Pamela Eric Kevin Mary Jessica Patricia Barbara Karen Sarah Robert John Daniel Jason Joe
The infected emails can have any of the following subjects:
returned mail failure delivery failed transaction server error mail failure Delivery Status (Failure)
The body of the message will be chosen from the following list:
This is an automatically generated Delivery Status Notification. Delivery to last recipient failed. Email returned as attachment text file. Message from Mail Delivery Server. Unable to deliver message to last recipient. Email returned as text file. Email returned by the server as ASCII Text mail file. To read the email download the included attachment. Mail Server Notice: Last email sent could not reach intented destination. Email returned as ASCII text file. The last email sent by this account could not reach intended destination. Email has been returned as text file attachment. Mail Delivery Status Notification: Message returned by server. Message returned as text file attachment.
Based on the computer uptime obtained through GetTickCount, with 80% probability the attachment name will be:
A + "." + B
Where A and B are any of a list of words. A can take the values "body", "message", "email". And B any of "scr", "txt.scr" or "html.scr".
With 10% probability the attachment name will be composed in the same form as just described, but the list A is augmented with "text" and "document" and B with "outlook.scrtxt.exe".
This last value "outlook.scrtxt.exe" is, most likely, a mistake of the author, who probably intended to write "outlook.scr" and "txt.exe". If the worm attempts to use the unexisting last string, it might lead to unexpected behavior such as an invalid memory access, therefore leading Windows to terminate the task.