I-Worm.Zircon.c
Description I-Worm.Zircon.c
This is a worm virus spreading via the Internet in infected e-mails. The worm itself is a Windows PE EXE file about 12Kb in size, written in Assembler.
The infected messages contain the following information:
Subject: 'Important' or a Japanese language subject (17 variants)
Body: [empty]
Attach: patch.exe
The worm activates from an infected e-mail only when a user clicks on the attachment.
The worm does not install itself in the system and once run is no longer active - unless a user clicks on the attachment once again.
Spreading
To send out infected messages the worm reads the address of the default Outlook SMTP server from the registry and connects to it. Then the worm reads addresses from the Windows address book. It then sends messages to all addresses found in the Windows address book. If the recipient's address ends with the string ".jp" the worm inserts a Japanese subject. If not it inserts the subject: "Important".
The worm contains the text string:
XXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXX I-Worm.Japanize XXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXX
Check other viruses! Be aware! Use Antiviral Software
Rogue.1206
Description Rogue.1206
This is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. The virus deletes the CHKLIST.* files. Depending on the system date it also hooks INT 8 and displays the message:
Now you got a real virus! I'm the ROGUE all!
On the same date it corrupts the DBF files.
It contains the encrypted string:
TEDESVAMORTEQUIERODOROINIMAGINABLE 20-03-89 8:57PM
Rogue.1807
Description Rogue.1807
This is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and to the middle of EXE files. The virus deletes the CHKLIST.* files. Depending on the system date it also hooks INT 8 and displays the message:
Now you got a real virus! I'm the ROGUE all!
On the same date it corrupts the DBF files.
On September 29 it displays the message:
MS-DOS cheking MCB's.
Please wait...
I'am The Rogue.
|