W32/Liac is an email worm. This worm infects Windows systems. It spreads using Microsoft Outlook by sending worm infected mails to all the contacts in the Windows address book.

It arrives with the following subject:

FW:FW: LILAC project video attach

The body of the mail contains the following message:

Things that the govt. dont want you to know

The infected mail will contain the following attachment:

LILAC_WHAT_A_WONDERFULNAME.avi.exe.

Upon execution of the infected attachment, it displays a false message box with the title, Windows. It displays a message, Error54: Media Player not installed correctly. The dialog box has only an OK button displayed, for the infected user to click.

After this, the worm copies itself as LILAC_WHAT_A_WONDERFULNAME.avi.exe, under Windows Temp folder. The worm emails a copy of itself to all the contacts in the address book.

The worm creates registry entry at the following location to load itself at the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm also makes modifications to the following registry location

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon

As a result of the above modification, the worm displays a message box with the title, Owned by:, and the message, Owned by: xEnOcrAtEs. This message is displayed when the computer is re-started.

This worm first appeared on 8th July 2002.

Other names of W32/Liac worm:

This worm is also known as WORM_LIAC.A, W32/Calil-A, Lilac, I-worm.Calil.