W32/Tibsorm is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The 'From' address of the infected email will be any one of the following;

Emely Hard
Fred Dowland
Jane Hoocks
John Heckman
Lorence Newman
Michel Madsen
Nick Convers
Oliver Simpson
Patrik Roberts
Piter Roslen

The 'Subject' of the infected mail will be any one of the following;

Pay for your credits!
Tank you for your charity
Thank you for your registration!
Thank you for your purchase in Bolero!
It's important!!! You still have not paid a fine!

The 'body' of the infected mail will be any one of the following;

Hello!
We have to remain you that your credit payment period will be expiring next week. If you will not make your payment till that time we will have to withdraw your savings from your bank account.
All details you can find enclosed.
USA Credit Group.

The St. Patrick Home thanks you for your donation. We are very obliged for your assistance with our St. Patrick's Found and acknowledge the receipt of your transfer for its account. Further to our letter we are sending you full estimate of that transfer.
Sincerely yours, St. Patrick Home's Administration

Hello!
Thank you for your rewrite in our mail server. The confirmation of you new login and password you can find enclosed.
Sincerely yours, Mail Administration Service / Mail Support Service

Hello!
Thank you for your purchase in our Internet-shop. We always appreciate to meet you there and would like to inform you that money was successfully transferred from your credit card to our account. Further information you can find enclosed.
Sincerely yours, Bolero Inetshop Administration

Hello!
We remain you that you still have not paid a parking violation fine. You should to pay it till the next week or we will have to reach trial the deal.
We are sending you herewith all necessary documents.
Sincerely yours, Regional Police Department Management / Administration

The name of the infected attachment will be any one of the following;

data.zip
logfile.zip
message.zip

Upon execution of the infected attachment, the worm copies itself as mfcapi32u.exe in the Windows system folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also attempts to download and execute a file from;
http://(traffall.biz)/adv/053/win32.exe

To propagate itself, the worm scans the files having the following extensions to collect all the available email addresses from the infected system.

.asa, .asc, .asm, .asp, .cfg, .cgi, .con, .csp, .dbx, .dlt, .dwt, .edm, .eml, .hta, .htc, .htm, .inc, .jsp, .jst, .lbi, .log, .ods, .oft, .php, .mbx, .mdx, .mht, .mmf, .msg, .nch, .rdf, .rss, .sht, .ssi, .stm, .tbb, .tbi, .tpl, .txt, .uin, .vbp, .vbs, .wab, .wml, .wsh, .xht, .xls, .xml, .xsd, and .xst.

The worm does not send mails to addresses containing any of the following strings;

certific, listserv, ntivi, support, admin, postmaster, root, samples, spam, noone, nobody, info, help, gold-certs, feste, contact, bugs, anyone, rating, secur, linux, unix, pgp, panda, google, sopho, icrosoft, avp, iana, foo, msn, gmail, hotmail

This worm first appeared on August 16, 2006.

 Other names of W32/Tibsorm Worm:

This Worm is also known as Worm/IBill.A, W32.Toyep.A@mm, W32/Toyep@MM.