| Description:
|
Details
I-Worm.Vote
This Internet worm spreads via e-mail messages using MS Outlook. Upon being executed, the worm sends infected messages to all addresses stored in the Outlook address book, then it overwrites all HTML files on the local disk drives. Upon the next Windows start-up, the worm tries to delete all files in the Windows folder, and reboots the computer.
The worm arrives to a computer as an e-mail message with an attached executable file that is the worm itself. The malicious message contains the following:
The worm doesn't run automatically from e-mail. It is activated only when a user starts it manually (by double-clicking on the attachment).
Upon being executed, the worm sends infected messages to all addresses stored in the Outlook address book. Then it opens two Internet browsers utilizing sites that are closed at the moment. Also, it replaces the Internet Explorer start-up page with one of its own. Following this, the worm drops two different VBS files.
The first one is named "MixDaLaL.vbs" that the worm creates and runs immediately in the Windows folder. This file has a script program that searches for files with HTM and HTML extensions on all removable and local hard drives, and overwrites them with a short text:
AmeRiCa allFew Days WiLL Show You What We Can Do !!! It's Our Turn >>> ZaCkEr is So Sorry For You
The second VSB file the worm drops into the Windows system folder with the name, "ZaCker.vbs", and registers it in the auto-run registry section. This means the file will be automatically executed upon the next Windows start-up. Upon being executed, it attempts to delete all files in the Windows directory, overwrites AUTOEXEC.BAT with a command destroying all data on drive C:, and then it displays the following message:
The worm finally reboots the computer. As a result, the system may be rendered unbootable or all data may be destroyed. |
