Virus

W32/Taripox.B

Analysis

  • Virus is 32bit and has a UPX compressed size of 21,504 bytes
  • When virus is executed, it will write itself to the Windows folder as “mmoplib.exe”
  • Virus will modify the registry to load at Windows startup-
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\Run\
    mmopl = C:\Windows\mmoplib.exe
  • When emails are sent via SMTP, virus may add an infected file attachment to the original email, as in this example –
    [Original]
    To: [anyone]
    Subject: [anything]
    Body: [anything]
    Attachment: [none]

    [Modified]
    To: [anyone]
    Subject: [anything]
    Body: [anything]
    Attachment: [infected file attachment]

  • Virus contains this string –
    W32.Taricone-B.worm@proxy by I.V.E.L.