This is a virus-worm that spreads via the Internet attached to infected e-mail. The worm itself is a Windows PE EXE file about 30Kb in length (compressed by UPX, 76K decompressed), and it is written in Microsoft Visual C++.
Infected messages appear as follows:
Subject: new photos from my party!
Body: Hello!
My party... It was absolutely amazing!
I have attached my web page with new photos!
If you can please make colour prints of my
photos. Thanks!
Attachment: www.myparty.yahoo.com
The worm activates from infected e-mail only when a user double-clicks on the attached file. The worm then installs itself to the system and runs a spreading routine.
Installing
While installing, the worm copies itself to:
c:\regctrl.exe - under Win9x/ME
c:\recycled\regctrl.exe - under WinNT/2K/XP
and spawns this copy. When the worm's file name is not ".com" (as in the attachment), but rather ".exe" (the worm is re-named), it also opens the Web page "http://www.disney.com".
The original file (as it was run from an infected e-mail) is moved
to the Recycled or Recycler directory with one of the following names:
C:\RECYCLER\F-%1-%2-%3
C:\RECYCLED\F-%1-%2-%3
where %1, %2, %3 are randomly selected numbers, for example:
F-12158-19044-21300
F-27729-23255-31008
While installing, the worm checks the keyboard layout set, and when there is Russian keyboard support, the worm copies itself to Recycled/Recycler in the same way and exits. This is the same on any date except for 25-29 January 2002.
As a result, the worm works only from 25 until 29 January 2002, and only on machines without Russian keyboard support.
Spreading
To send infected messages, the worm uses a direct SMTP connection
to an e-mail server. To obtain a victim's e-mail addresses, the worm scans
WAB files (Windows Address Book) and *.DBX files (Outlook Express).
The worm also sends one e-mail (without an attachment) to "napster@gala.net".
Backdoor
Under WinNT/2000/... the worm also creates a new file in a user's
auto-run directory:
%Userprofile%\Start Menu\Programs\Startup\msstask.exe
and writes a backdoor program to there. This backdoor is run by data
that are stored in a file at the Web site "http://209.151.250.170".
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
290102/110904/051004
