Virus Update(r) - Page 2

The Payload
Of course, clicking on the attachment (or having it opened in Outlook Express' Preview Pane) will launch the executable and infect the machine. A fake File Open Error message is displayed stating: "Cannot Open File: It does not appear to be a valid archive. If you Downloaded this file, try Downloading the file again." This is intended to make the user believe that the file was merely corrupted, and not malicious.

When Updater is launched, it will copy and mail itself to everyone in the Outlook Address Book; it then saves a copy of itself in the WINDOWS or WINDOWS/SYSTEM32 directory, and creates a registry key:

Also, a Visual Basic script is written to C:\WINDOWS\STARTM~1\PROGRAMS\STARTUP\Update.vbs

The former causes the virus to run again at Windows' restart if it has not been fully eradicated, while the latter searches your local and mapped network drives for .DOC, .EXE and .TXT files and saves a copy of itself there. It does not alter the files it finds, but rather creates a new file with the same name and appends .VBS. Therefore, README.TXT becomes README.TXT.VBS.

The script reads as follows:

   I-WORM.IMELDA.B
   (C)2001, by Iwing
   Virusindo - Indonesian Virus Network
   http://indovirus.8m.com , IRC Dalnet #indovirus