Nasty New Year Virus - Page 2

The Payload
Now for the nasties. There appear to be number of variants of the worm itself. In all circumstances, Reeezak copies itself to the Windows directory under the name CHRISTMAS.EXE. Different variants will do some of the following:

A process called sm56hlpr is created, and the keyboard is blocked.

As is always the case with mass-mailing worms, Reeezak will attempt to propagate by mailing itself to all entries in the Outlook or Outlook Express address book.

These entries may be made to the Windows registry:

  HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run/ZaCker

This entry is assigned the CHRISTMAS.EXE value, pointing to the location of the file containing the worm. As a result, the malicious program will run each time Windows is launched.

  HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/ComputerName/
   ComputerName/ComputerName = "ZaCker"

Through this entry, the worm changes the name of the computer to ZaCker.

  HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main/
   Start page = http://geocites.com/jobreee/ZaCker.htm

This modifies the Internet Explorer start page, and will send your browser to a really nasty sitewhich will try to exploit a vulnerability in IE and run a Visual Basic Script on the infected computer that will attempt to delete significant portions of the Windows operating system.

If Reeezak is run on a Windows NT system, it will spawn a series of processes and title bars called Christmas until it uses up the computer's memory.

Some reports have been filed that the program will also try to exploit mIRC (as Goner did) and shared network drives, particularly peer-to-peer shared folders.