dcsimg

Nasty New Year Virus - Page 2

 By Jim Freund | Posted Dec 20, 2001
Page 2 of 3   |  Back to Page 1
Print Article

The Payload
Now for the nasties. There appear to be number of variants of the worm itself. In all circumstances, Reeezak copies itself to the Windows directory under the name CHRISTMAS.EXE. Different variants will do some of the following:

A process called sm56hlpr is created, and the keyboard is blocked.

As is always the case with mass-mailing worms, Reeezak will attempt to propagate by mailing itself to all entries in the Outlook or Outlook Express address book.

These entries may be made to the Windows registry:

  HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run/ZaCker
This entry is assigned the CHRISTMAS.EXE value, pointing to the location of the file containing the worm. As a result, the malicious program will run each time Windows is launched.
  HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/ComputerName/
   ComputerName/ComputerName = "ZaCker"
Through this entry, the worm changes the name of the computer to ZaCker.
  HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main/
   Start page = http://geocites.com/jobreee/ZaCker.htm
This modifies the Internet Explorer start page, and will send your browser to a really nasty sitewhich will try to exploit a vulnerability in IE and run a Visual Basic Script on the infected computer that will attempt to delete significant portions of the Windows operating system.

If Reeezak is run on a Windows NT system, it will spawn a series of processes and title bars called Christmas until it uses up the computer's memory.

Some reports have been filed that the program will also try to exploit mIRC (as Goner did) and shared network drives, particularly peer-to-peer shared folders.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter

By submitting your information, you agree that enterprisenetworkingplanet.com may send you ENTERPRISENetworkingPLANET offers via email, phone and text message, as well as email offers about other products and services that ENTERPRISENetworkingPLANET believes may be of interest to you. ENTERPRISENetworkingPLANET will process your information in accordance with the Quinstreet Privacy Policy.