|
|
IRC-Worm.Anump Viruses Information
| Name: |
IRC-Worm.Anump |
| Category: |
Viruses |
| Description:
|
Details
IRC-Worm.Anumps
This worm spreads via IRC channels and infects MS Word documents. The virus itself is a Word document containing a macro named Mumps.
Installation
When opened, the file will:
attempt to disable the Security menu in the Macro menu
disable the ban on activating macros in the Windows system registry
create a file named Mumps.drv in C:Windows directory and writes the code of the macro to this file. This file is then used to infect all open Word documents
save the active document to the hard drive under the following names:
C:WindowsFAQ.doc
C:Program FilesMicrosoft OfficeOfficeSTARTUPMumps.dot
commences propagation via IRC.
Propagation via IRC
The worm modifies a file named script.ini file. This means the file C:WindowsFAQ.doc will automatically be sent to all users of the channel used by the infected computer.
Signs of infection
When the user tries to open the HelpAbout menu, the worm changes the background colour of the document to dark blue. Letters will appear in white. It also open notepad.exe displaying the following text:
"Windows has low memory resources. Please restart your Windowsall.."
If the user tries to print the current document and the system clock is showing 59 seconds, a Message Box with the following text will be displayed:
"Your printer driver is not compatible with Windows. Please install another printer drivers."
If the user tries to view the code of the Macros or open the ToolsMacro menu, a Message Box with the following text will be displayed:
"There is something a trouble with this function..."
Other
The worm attempts to register C:WindowsFAQ.doc in the system registry as the default signature for Microsoft Outlook 5.0. The file will then automatically be added to all outgoing mail. |
Top Viruses Visited Pages:
Invader. - 241 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 67 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Arale.152
SSR.73
Locust Famil
Win32.InvictusDLL.103.
Trojan.Win32.Antige
Brezhnev.97
Worm.P2P.Duload.
P
PoorMan.1168
WinLamer2.173
|
|
