Tuesday, January 16, 2001.
WM97.Chronic.A
Anti-virus software developer Sophos reports the detection
of the two latest Word 97 macro-viruses.
The first is the unremarkable WM97.Eight941.R,, which
spreads but does not have a working payload.
The second is WM97.Chronic.A, which has a complex trigger
mechanism, and under some circumstances, can overwrite the CMOS settings.
The virus maintains a count of the number of times the
viral code is executed, and every 25th time (25, 50, 75, etc.) the code runs and the virus runs the
payload.
The payload consists of a complex series of checks on
the day part of the date.
If the day part of the date can be divided exactly by
5, the virus will attempt to set the write password for the current document
to a value gained from the system. The password will normally be "1297307460".
The main part of the payload consists of modifying the
first 1020 bytes of specific files and also appending the text "Karachi_y2k7"
to those same files. The specified file paths are usually only found under
the Windows 95 and Windows 98 operating systems. This corrupts the files
in such a way that they no longer work.
Every time the payload runs, the following files are affected:
"C:\WINDOWS\SOL.EXE"
If the day can be divided exactly by 3, the following
files are affected:
"C:\WINDOWS\ROUTE.EXE"
If the day can be divided exactly by 3 and by 6, the following
files are affected:
"C:\WINDOWS\SYSTEM\NETCPL.CPL"
If the day can be divided exactly by 3 and by 6 and by
9, the following files are affected:
"C:\WINDOWS\SYSTEM\LPT.VXD"
If the day can be divided exactly by 2, the virus attempts
to print between 1 and 9 copies of the current document.
If the day can also be divided exactly by 4, the virus
modifies "C:\WINDOWS\WIN.COM" to contain the Trojan Troj/KillCMOS-E, which
is a Trojan that overwrites the CMOS settings with random data. This is
run the next time Windows is restarted.
If the day can also be divided exactly by 6, the virus
copies "C:\WINDOWS\WIN.COM" to "WIN.ORG", and then creates a new "C:\WINDOWS\WIN.COM"
with the Trojan Troj/KillCMOS-E, which is a Trojan that overwrites the
CMOS settings with random data. This is run the next time Windows is restarted.
"C:\WINDOWS\MSHEARTS.EXE"
"C:\WINDOWS\FREECELL.EXE".
"C:\WINDOWS\PING.EXE"
"C:\WINDOWS\SYSTEM\NETOS.DLL"
"C:\WINDOWS\SYSTEM\NETDI.DLL"
"C:\WINDOWS\SYSTEM\NETBIOS.DLL"
"C:\WINDOWS\SYSTEM\NETAPI.DLL"
"C:\WINDOWS\SYSTEM\NETAPI32.DLL".
"C:\WINDOWS\SYSTEM\INETCPL.CPL"
"C:\WINDOWS\SYSTEM\MODEM.CPL"
"C:\WINDOWS\SYSTEM\URL.DLL"
"C:\WINDOWS\SYSTEM\SENDMAIL.DLL"
"C:\WINDOWS\SYSTEM\MAPI32.DLL"
"C:\WINDOWS\SYSTEM\INETCOMM.DLL"
"C:\WINDOWS\SYSTEM\INETCFG.DLL"
"C:\WINDOWS\SYSTEM\INETAB32.DLL"
"C:\WINDOWS\SYSTEM\INET16.DLL".
"C:\WINDOWS\SYSTEM\SPOOL32.EXE"
"C:\WINDOWS\SYSTEM\MSPRINT.DLL"
"C:\WINDOWS\SYSTEM\MSPRINT2.DLL".
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5)THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
