|
|
I-Worm.Luck Viruses Information
| Name: |
I-Worm.Luck |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.Lucky
This is a family of Internet worm that spread via e-mail by sending infected messages from infected computers. While spreading, the worms use MS Outlook and send themselves to all addresses that are stored in the MS Outlook Address Book. As a result, an infected computer sends as many messages to as many addresses are maintained in the MS Outlook contacts list.
There are two worm variants known. Both have bugs in their code and are not able to spread, but these bugs can be easily fixed by a hacker.
The worms are written in the scripting language "Visual Basic Script" (VBS), and they work only on computers on which the Windows Scripting Host (WSH) is installed. In Windwos 98 and Windows 2000, WHS is installed by default. To spread, the worms access MS Outlook and use its functions and address lists. This is available in Outlook 98/2000 only, so the worms are able to spread only when one of these MS Oulook versions is installed.
Spreading
The worm arrives to a computer as an e-mail message with an attached VBS file that is the worm itself. The message in the original worm version contains:
The Subject: Prinz Charles Are Die
Message body: The newest Message for Cool User's. Lucky2000
Attached file name: COOL_NOTEPAD_DEMO.TXT.vbs
Depending on system settings, real extension of an attached file (".vbs") may not be shown. In this case, the filename of the attached file is displayed as "COOL_NOTEPAD_DEMO.TXT".
Upon being activated by a user (by double clicking on the attached file), the worm dispalys the following message:
eXposed
eXposed is being installed
Then it creates a shortcut on the desktop to a PIF-file that exits Windows. The worm sets a shortcut icon to a non-existing file, so the shortcut has a standard icon - a windows flag with white background. After this, the worm displays the following message:
CLICK THE BLUE BOTTLE ICON ON THE DESKTOP OR YOUR HARD DRIVE WILL BE LOST!
eXposed IS A VIRUS IT WILL DAMAGE YOUR COMPUTER
Then the worm begins speading - it opens MS Outlook, gets access to the Address Book, gets all addresses from there and sends messages with its attached copy to all of them. The message subject, body and attached file name are the same as above.
The worm also installs itself into the system. It creates its copy in the Windows directory with the "Prinz_Charles_Are_Die.TXT.vbs" name:
This file is then registered in the Windows auto-run section in the system registry:
HKLMSoftwareMicrosoftWindowsCurrentVersionRunPrinz_Charles_Are_Die = Prinz_Charles.Are.Die.TXT.vbs
As a result the worm is re-activated each time Windows boots up.
Other variants
The worm itself is a text script program, and it is spread in text source form. The worm's code may be easily modified by hackers, and as a result, there are many variants of the worm that may have appeared. Usually only minor changes are made.
I-Worm.Lucky.b
This worm variant is very close to the first one. Upon being activated, it displays other messages:
Price
Price are here
and:
CLICK THE BLUE BOTTLE ICON ON THE DESKTOP AND YOU WIN ONE MILLION DOLLAR !!!
The infected message contains:
The Subject: Won_a_Price
Message body: One Million Dollar for you. Lucky2000
Attached file name: Won_a_Price.TXT.vbs |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Linux.OSF.875
DogPaw.72
DSU.142
Ultimate.48
MtE.Coffeesho
Velocet.200
CopyProtected.51
Justic
LionKing.353
Slovakia.162
|
|
