MSIL/Lemidon [Threat Name] go to Threat

MSIL/Lemidon.A [Threat Variant Name]

MSIL/Lemidon.A is a worm that spreads via shared folders and removable media. The worm contains a backdoor. It can be controlled remotely.

When executed, the worm copies itself into the following location:

In order to be executed on every system start, the worm sets the following Registry entry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "Silverlight Application" = "%appdata%\Silverlight.exe"

The worm creates the following file:

The worm copies itself into the root folders of removable drives using the following name:

The following file is dropped in the same folder:

Thus, the worm ensures it is started each time infected media is inserted into the computer.

The worm tries to copy itself to the available shared network folders.

The following names of the shared network folders are used:

The following filename is used:

MSIL/Lemidon.A is a worm that spreads via IM networks.

If Skype is installed on the infected system, the worm sends a message with a URL to all contacts.

The message contains a link to a file with the following name:

MSIL/Lemidon.A is a worm that spreads via P2P networks.

The worm searches for shared folders of the following programs:

When the worm finds a folder matching the search criteria, it creates a new copy of itself.

The following names are used:

A string with variable content is used instead of %variable% .

The worm collects information related to the following applications:

The worm can send the information to a remote machine.

The worm acquires data and commands from a remote computer or the Internet.

The worm connects to the following addresses:

The IRC protocol is used.

It can execute the following operations: