Home Malware Programs Worms MSIL.Pizzer

MSIL.Pizzer

Posted: May 28, 2013

Threat Metric

Ranking: 4,132
Threat Level: 1/10
Infected PCs: 4,462
First Seen: May 28, 2013
Last Seen: October 15, 2023
OS(es) Affected: Windows

MSIL.Pizzer is a worm that proliferates through file sharing programs and social media services. MSIL.Pizzer also strives to mine BitCoin data. MSIL.Pizzer requires .NET Framework version 2.0 or later to be run. When MSIL.Pizzer is executed, it downloads a file from the certain location. MSIL.Pizzer saves it as the specific file and executes it. MSIL.Pizzer then creates the registry entry, so that it can run every time the target PC user is starts Windows. MSIL.Pizzer downloads hack tools from the specific locations to steal Facebook account information and passwords from Google Chrome, Mozilla Firefox, and Internet Explorer. MSIL.Pizzer then updates the Facebook Wall of the stolen account with the particular message. MSIL.Pizzer also creates the potentially malicious file. MSIL.Pizzer searches for all .zip and .rar files on all logical drives found on the infected computer and inserts itself into the archives if WinRAR is installed. MSIL.Pizzer then creates the script file. The script file sends the message to all contacts found in Skype. MSIL.Pizzer replicates itself as the potentially malicious file with an 'autorun.inf' file and sets the attributes of both files to hidden. MSIL.Pizzer replicates itself as the malevolent files.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%UserProfile%\Application Data\AudioDrivers.exe File name: %UserProfile%\Application Data\AudioDrivers.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%UserProfile%\Application Data\temp48.txt File name: %UserProfile%\Application Data\temp48.txt
Mime Type: unknown/txt
Group: Malware file
%UserProfile%\Application Data\s4c.vbs File name: %UserProfile%\Application Data\s4c.vbs
Mime Type: unknown/vbs
Group: Malware file
[LOGICAL DRIVE LETTER]:\ntldr.exe File name: [LOGICAL DRIVE LETTER]:\ntldr.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Messenger\[FOLDER NAME]\mypornpics.scr File name: C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Messenger\[FOLDER NAME]\mypornpics.scr
Mime Type: unknown/scr
Group: Malware file
C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Yahoo Messenger\[FOLDER NAME]\ys.scr File name: C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Yahoo Messenger\[FOLDER NAME]\ys.scr
Mime Type: unknown/scr
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Nividia Video Driver" = "[PATH TO WORM]\[WORM FILE NAME].exe"

Additional Information

The following messages's were detected:
# Message
1Lady Gaga PREGNANT?!?! see for yourself. [http://]authentication.myvnc.com/inde[REMOVED]
2omg! you have to see this.. [http://]authentication.myvnc.com/inde[REMOVED]

Loading...