Nasty New Year Virus - Page 2

By Jim Freund | Posted Dec 20, 2001
Page 2 of 3   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

The Payload
Now for the nasties. There appear to be number of variants of the worm itself. In all circumstances, Reeezak copies itself to the Windows directory under the name CHRISTMAS.EXE. Different variants will do some of the following:

A process called sm56hlpr is created, and the keyboard is blocked.

As is always the case with mass-mailing worms, Reeezak will attempt to propagate by mailing itself to all entries in the Outlook or Outlook Express address book.

These entries may be made to the Windows registry:

  HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run/ZaCker
This entry is assigned the CHRISTMAS.EXE value, pointing to the location of the file containing the worm. As a result, the malicious program will run each time Windows is launched.
  HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/ComputerName/
   ComputerName/ComputerName = "ZaCker"
Through this entry, the worm changes the name of the computer to ZaCker.
  HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main/
   Start page = http://geocites.com/jobreee/ZaCker.htm
This modifies the Internet Explorer start page, and will send your browser to a really nasty sitewhich will try to exploit a vulnerability in IE and run a Visual Basic Script on the infected computer that will attempt to delete significant portions of the Windows operating system.

If Reeezak is run on a Windows NT system, it will spawn a series of processes and title bars called Christmas until it uses up the computer's memory.

Some reports have been filed that the program will also try to exploit mIRC (as Goner did) and shared network drives, particularly peer-to-peer shared folders.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter