Alias:I-Worm.Melhack; OsamaLaden.vbs
Type:Worm 
Size:122.664 Bytes 
Origin: 
Date:09-12-2002 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:Low 

DistributionThe email sent by Worm/Nedal contains:
Subject: Osama Bin Laden Comes Back!

Body: Hello People,
You have received Email from Osama Bin Laden.
Allah is The One Of God. No god in the World Accept Allah!
All people in the world love peace and no wars. America and Israel must be destroy to prevent from wars.
Your Sincerely,
Osama Bin Laden
Al-Qaeda Network

Attachment: The email has no attachment. The virus code is inserted as HTML text, used for showing the message.

Technical DetailsWorm/Nedal is an Internet Worm, spread by email.
When the email is opened, the virus code is activated using ActiveX. Some computer systems show a Windows message to ask if ActiveX should be run. If the user answers YES, the worm is activated. Worm/Nedal creates the file OsamaLaden.vbs and copies it in:
C:\%WinDIR%\
C:\%WinDIR%\%SystemDIR%\
C:\%WinDIR%\Temp\
Another worm copy is made in C:\Windows\, as 'OsamaBinLaden.vbs'.
A DOS window is displayed.

Worm/Nedal creates the following files:
-'Laden.EXE' in C:\Windows\ (4.608 Bytes). The Trojan component, which displays a window on every September, 11.
-'Osama.EXE' in C:\Windows\ (17.174 Bytes). It infects .exe files and affects their original contents.
-'Alta.EXE' (5.120 Bytes). It is a Windows Trojan. It displays the text: "Prepare to sleep..." and then shuts the system down.
-'Laden.BAT' in C:\ (103 Bytes). This file deletes the contents of Windows System directory. Then, the system is shut down.

The worm makes the following registry entries:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "OsamaBinLaden"="wscript.exe c:\\%WinDIR%\\%SystemDIR%\\OsamaLaden.vbs %""OsamaLaden"="C:\\OsamaLaden.bat" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "AltaWorm"="Alta.exe""Laden"="Laden.exe"

and with the following entry, it changes the Internet Explorer Start site:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\]Start Page=http://melhacker.netfirms.com/BinLaden.exe
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .