Virus Update(r) - Page 2

By Jim Freund | Posted Dec 6, 2001
Page 2 of 3   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

The Payload
Of course, clicking on the attachment (or having it opened in Outlook Express' Preview Pane) will launch the executable and infect the machine. A fake File Open Error message is displayed stating: "Cannot Open File: It does not appear to be a valid archive. If you Downloaded this file, try Downloading the file again." This is intended to make the user believe that the file was merely corrupted, and not malicious.

When Updater is launched, it will copy and mail itself to everyone in the Outlook Address Book; it then saves a copy of itself in the WINDOWS or WINDOWS/SYSTEM32 directory, and creates a registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ Run\Update=C:\WINDOWS\Update.exe

Also, a Visual Basic script is written to C:\WINDOWS\STARTM~1\PROGRAMS\STARTUP\Update.vbs

The former causes the virus to run again at Windows' restart if it has not been fully eradicated, while the latter searches your local and mapped network drives for .DOC, .EXE and .TXT files and saves a copy of itself there. It does not alter the files it finds, but rather creates a new file with the same name and appends .VBS. Therefore, README.TXT becomes README.TXT.VBS.

The script reads as follows:

   I-WORM.IMELDA.B
   (C)2001, by Iwing
   Virusindo - Indonesian Virus Network
   http://indovirus.8m.com , IRC Dalnet #indovirus
Thereafter, on the 12th of each month, a message will appear, stating "Hi there... you are infected by some of IWING creations... Have a nice day."

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter