A2K.Damcor

Discovered:
    May 18, 2004
Updated:
    February 13, 2007 12:23:23 PM
Type:
    Worm
Systems Affected:
    Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When A2k.Damcor is executed, it performs the following actions:

    Launches Microsoft Access in order to execute the Macro code.

    Attempts to use Microsoft Outlook to email itself to all contacts in the address book.

    The email has the following characteristics:

    Subject: Re: Saddam Corrupted
    Body: Please find the details of Saddam Corrupted  
    Attachment: account.mdb

    Length: Unknown

Technically A2K.Damcor is a worm, a type of malware that replicates and circulates without human intervention. A2K.Damcor can replicate and spread not only inside of your computer, but also to other computers connected to your network.

What makes worms like A2K.Damcor extremely dangerous is its ability to spread quickly. A A2K.Damcor infection hits very fast; so quickly that you won’t even be aware that it was A2K.Damcor that infected your computer.

When A2K.Damcor infects your computer, it tries to create a copy of itself as a Windows executable file (.EXE). After infecting you computer, A2K.Damcor will attempt to use your network to connect with its source computer. The primary intention is to update itself and download other malware programs and files.

A2K.Damcor also attempts to infect the Windows Registry of your computer. The purpose is to remain undetectable, protect other malicious programs it downloads, start up when the computer boots, and ultimately take full control over your computer.

2. Netsky and Sasser

Assessed Harm: a huge number of dollars; shut down the satellite interchanges for some French news organizations; a few Delta carrier flights were dropped; shut down various organizations' frameworks around the world.

Sasser started spreading on April 30, 2004; it took advantage of a security imperfection in non-refreshed Windows 2000 and Windows XP frameworks. At the point when effectively repeated, the worm would check for other unprotected frameworks and send itself to them.

Netsky spread by means of email and Windows organizations, making a lot of Web traffic and causing Disavowal of Administration (DoS) assaults. At that point, Netsky and every one of its variations were accepted to have represented upwards of 25% of all PC infections on the Web. Sasser imitated by tracking down different frameworks with weaknesses and compelling them to download the infection. When it was on another machine, it modified the working framework to make it challenging for clients to close down their PC.

Delivered in February and April 2004 separately.

Made by 17-year old Sven Jaschan.

One of a handful of the infections to be followed back to their maker.