Enemany is a family of simple email worms created my Energy. By the time of the creation of this description 4 variants were known. All 4 variants are packed with UPX file compressor and are written in Visual Basic. These worms have no payload.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Variant:Enemany.A
This variant is intended as it has a bug that prevents it from sending its file attached to an email. When the worm is run, it shows a fake error message and installs itself to system 3 times:
C:\WINDOWS\Xerox-Update.Exe C:\WINDOWS\SYSTEM\Ati.scr C:\WINDOWS\Start Menu\Programs\StartUp\WinUpdate.exe
Then the worm opens Outlook Address Book and tries sends itself to all email addresses found there. The infected message looks like that:
Subject:
The New Xerox Update for our WinXP
Body:
Dear, Microsoft WinXP User, here are the last Update from Xerox Security System, please install this file and going to www.microsoft.com and finished this Update too.
The attachment name should have been 'Xerox-Update.Exe', but the worm tries to attach 'Xerox-Update.exe.exe' file instead and as this file is not found, the worm fails to send itself out.
Variant:Enemany.B
When the worm is run it installs itself to system a 2 times:
C:\WINDOWS\Esel_Update.Exe C:\WINDOWS\SYSTEM\Edonkey.scr
Then the worm creates a startup key for its installed file 'C:\WINDOWS\Esel_Update.Exe' in System Registry:
\Software\Microsoft\Windows\CurrentVersion\RunServices
Then the worm opens Outlook Address Book and tries sends itself to all email addresses found there. The infected message looks like that:
Subject:
Edonkey Update
Body:
Hello Edonkey User, this is the Update tool, to fix our Edonkey Client to 35.16.61
Attachment:
Esel_Update.exe
Variant:Enemany.C
The Enemany.C variant has p-code instead of executable code in its body. When the worm is run it installs itself to system a 2 times:
C:\WINDOWS\teuro.Exe C:\WINDOWS\SYSTEM\Aspi32.scr
Then the worm opens Outlook Address Book and tries sends itself to all email addresses found there. The infected message looks like that:
Subject:
Alle gegen den TEuro
Body:
Sieh Dir mal Die Tabelle an, mit den neusten Information uber den teuren T-Euro
Attachment:
teuro.exe
Variant:Enemany.D
The Enemany.D variant is actually not a new variant. It's the bugfixed Enamany.A variant - the mass-mailing routine now works. See Enemany.A variant description for more info.