This is a worm that comes as an email with an attachment with a names sars.exe, Virus.exe, Corona.exe, death.exe, CV.exe from the emails sars2@hotmail.com, corona@hotmail.com.It is a very dangerous and spreads very fast when executed and slows down the PC.
Effects:
It does the following things when executed:
Changes the home page to http://www.who.int/csr/don/2003_04_19/en/
Drops its file CORONA.exe in windows folder
Adds itself to the registry key HKLM\Software\Microsoft\Windows\Current Version\Run "PC-Config32" = "C:\corona.exe -A"
Drops a file in C:\My Download or in the current directory where it is executed.
The corrupted file is filled with useless data that occupies...