Full description

Alias:	VBS.Stages.A
Type:	Worm
Size:	39.936 Bytes
Origin:
Date:	06-20-2000
Damage:	Sent by email to 100 Outlook addresses.
VDF Version:	6.01.00.14
Danger:	Low
Distribution:	Medium

DistributionIf Microsoft Outlook 9 (2000) is installed on the system, the worm tries to send itself to 100 addresses from Outlook Address Book. If there are more than 100 emails in the Book, the worm will randomly choose 100 emails:

Subject:

"Life stages"
"Funny"
"Jokes"
Eventually, "Re:" could preceed and "text" could end the subject.

Body:
variable.

Technical DetailsThe virus file extension will not be shown in Windows.
Only the file name LIFE_STAGES.TXT is to be seen. In order not to neglect its function after start, the virus creates a text file with the same name in Temp directory and shows this one for deceiving. For reassuring, the .SHS file icon will be replaced with the .TXT icon.

The insertion into the computer is done after a system restart, the worm being copied in Autostart folder, the first time it is opened. Then, it creates copies of itself in Windows directory:
- "MSINFO16.TLB" in Windows system
- hidden, "MSRCYCLD.DAT" in RecycleBin.
- random file name, out of: "IMPORTANT", "INFO", "REPORT", "SECRET" or "UNKNOWN". Eventually, "-" or "_" can be added, and a number between 1 and 999. These copies will be added in all root directories of the available drives (including network), in "My Documents" folder and in "Programs".

Then, a file named "SCANREG.VBS" is created in Windows system. This file is responsible for recovering files from backups.

Every system start will call the following registry entry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Services\Scan\Reg=SCANREG.VBS

A copy of this file is secured as "RCYCLDBN.DAT" hidden file in RecycleBin.

A second file, named "DBINDEX.VBS", is created in RecycleBin and copied in Windows system directory as VBASET.OLB.

If ICQ is installed on the computer, the program modifies the following registry entries:

HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Enable=Yes
HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Parameters=%C:\RECYCLED>\DBINDEX.VBS%
HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Path=%C:\WINDOWSW\SCRIPT.EXE%
HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Startup=%C:\WINDOWS%

Then, "SCRIPT.INI" is exchanged, using this program. The virus also moves "REGEDIT.EXE" into "RECYCLED.VXD".
For being activated by every system start through the registry, the worm deletes itself from Autostart.

說明撰寫者 Crony Walker 開啟 2004年6月15日星期二

返回 . . . .

需要修復電腦？

我的帳戶