| Description:
|
Details
I-Worm.Moncher
This is an Internet worm that spreads via e-mails attached as a EXE or ZIP file. The worm itself is a Win32 executable file about 37Kb in length, and written in Visual Basic. The worm is also able to spread via IRC channels.
When the worm's EXE file is being run from an attachment or from an IRC download directory, it registers itself in the system to run each time Windows starts up, and it sends infected messages. To hide itself, the worm displays two fake messages:
INSTALL
Install complete.
ERROR!
Unable to run program!
While installing into the system, the worm copies itself to the Windows directory with the WINHLP.EXE name, creates the VBS script file "helper" OUTLOOKHELP.VBS in the same directory, and registers these files in the Windows registry auto-run section:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
WinProfile = %WinDir%winhlp.exe
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
OutlookProfile = %WinDir%outlookhelp.vbs
where %WinDir% is the name of the Windows directory.
The first (EXE) file is the worm's main code, and the second (VBS) file is the e-mail spreading program.
When the VBS script is run, it connects to MS Outlook, obtains the addresses from the MS Outlook Address Book, and sends messages there. The message Subject, Body and Attachment appear as follows:
Subject: With Love
Body: Whit all my love for you. :)
Attach: Winhlp.exe èëè MonCherry.zip
The worm infects the mIRC client if it is installed in the C:MIRC directory. The worm writes a script to the SCRIPT.INI file in there that sends an infected WINHLP.EXE file to each user that enters the infected IRC channel.
On January 13th, the worm overwrites the C:AUTOEXEC.BAT file with a DOS batch program that will format the C: drive upon the next reboot. |
