Virus Database

VCode Family

Description VCode Family

VCode.1633
It is a harmless memory resident parasitic virus. It hooks INT 9, 21h and writes itself to the end of EXE files that are accessed. While installing memory resident the virus opens CONFIG.SYS file, searches for "SHELL" and "COMSPEC=" strings and infects the command interpreter. When Alt-Ctrl-Del keys are pressed it scans Environment area and also infects command interpreter. The virus contains the strings:
COMMAND.COM
SHELL
Program made in UV januar 93
CONFIG.SYS
COMSPEC=

VCode.1886,2540
These are dangerous nonmemory resident parasitic viruses. They search for .EXE files and write themselves to the end of the file. Depending on the current date they erase the disk sectors. They contain the text strings:
"VCode.1886": .93 all.........[[[ S C A N N E R ]]]
"VCode.2540": COMMAND.COM X:CONFIG.SYS

VCode.2246,2262
These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are accessed. While installing memory resident they open CONFIG.SYS file, search for "SHELL" string and infect the command interpreter. Depending on their internal counters these viruses hook INT 8 (timer) and sometimes change the keyboard flags.

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Unicle

Description I-Worm.Unicle

General Characteristics
This worm is able to work on Chinese versions of Windows only, and spreads itself by sending infected e-mail messages. The worm has two components: a script program and Windows PE EXE file. The first component (script) is sent in infected e-mails, infects the computer, then downloads and executes a EXE component that completes the infection and spreads the worm copies further.
Installation
The worm arrives as an HTML message with a JavaScript program inside. That script is automatically processed upon opening a message, and the worm code gets control.
Note:
Internet browsers and e-mail clients have built-in security protections that prevent script programs embedded into messages, to access disk files and system resources (the worm needs both to spread itself - see below). To infect the system from an e-mail message, the worm needs to avoid these protections. To do this, it exploits an Internet Explorer 5 security breach - a so-called "Scriptlet.Typelib vulnerability" (see below).
The worm then searches for the startup directory - it looks for Windows directories in the following order:
C:WINDOWSStart MenuPrograms-T-?
C:WINDOWStart MenuPrograms-T-?
C:WINStart MenuPrograms-T-?
C:WIN98Start MenuPrograms-T-?
C:WIN95Start MenuPrograms-T-?
C:WINDOWS.000Start MenuPrograms-T-?
C:WINDOWS.001Start MenuPrograms-T-?
D:WINDOWSStart MenuPrograms-T-?
D:WINDOWStart MenuPrograms-T-?
D:WINStart MenuPrograms-T-?
D:WIN98Start MenuPrograms-T-?
D:WIN95Start MenuPrograms-T-?
D:WINDOWS.000Start MenuPrograms-T-?
D:WINDOWS.001Start MenuPrograms-T-?
In case there are no such directories on the machine, the worm cannot infect the system and cannot spread further. The last characters in each line are Chinese strings, and they can't be used under any other local Windows version, which is why the worm is able to affect Chinese Windows only.
If any appropriate directory has been found, the worm creates "Microsoft Internet Explorer.hta" file in there. This file contains HTML Application that contains one more worm's script program. Because the file is created in Windows startup directory it will be executed at next Windows startup.
Onceexecuted "Microsoft Internet Explorer.hta" script creates MSIE.INI file in the Windows system directory and stores the local SMTP server address in there (the worm gets that SMTP server address from system registry).
Note:
the SMTP server is a machine that receives e-messages from computer. In cases where there is a stand-alone PC or email server, it is provider's address, or some other address that is used as a host email server to send [and receive] emails.
After that the worm creates "system" folder in Windows system directory (for example "C:WINDOWSSYSTEMsystem") and tries to download to there the MSIE.EXE file from the Internet. To do this the worm connects to one of ten FTP sites using script for standard utility FTP.EXE. If download fails the worm goes into a loop and attempts to repeat it every three minutes.
When the file MSIE.EXE is downloaded, the worm executes it (MSIE.EXE is selfextracting archive) and gets two more files:
EXPLORER.EXE
MSWINSCK.OCX
EXPLORER.EXE is the second worm component (Windows EXE file), and MSWINSCK.OCX is a library to access Windows sockets.
The worm then starts EXPLORER.EXE file that obtains the email addresses and sends infected messages with the worm's script program inside by using SMTP protocol. To acquire the victims' email addresses the worm scans the subdirectory tree on all drives, searching for *.NCH, *.SNM, *.DBX files (mail database files), it then scans them and looks for email addresses.
The worm's EXPLORER.EXE also performs additional actions. First of all it erases "traces" of its script component and deletes files that were created by it: MSIE.HTA, MSIE.LST, MSBOOT.BAT, MSIE.EXE. It then registers itself in WIN.INI file in the "run=" command to be automatically run on each Windows startup.
The worm will also notify its author (or possible host) about its presence on the infected machine. To do that it sends message to one of the addresses:
leebill_001@yahoo.com
leebill_002@yahoo.com
all
leebill_023@yahoo.com
there are 23 possible addresses, and the worm randomly selects one of them.
Payload
The worm has a "backdoor" payload that "listens" for a remote host and executes its commands: show a directory, open/close/create/execute/delete file, e.t.c.
Demo-versions of Kaspersky Lab AntiViral Toolkit Pro (AVP) able to combat against "Unicle" worm are available on Kaspersky Lab's Web site on http://www.kasperskylab.ru/eng/products/eval.asp.
You can purchase fully functional version of AntiViral Toolkit Pro online via the Internet on the following address: http://www.kasperskylab.ru/eng/buy/default.asp
How to protect against "Unicle" worm?
Microsoft has released an update that eliminates security "Scriptlet.Typelib" vulnerability. We strongly recommend you visit http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP and install this update.
If you do not use any HTML applications (HTA-files), there is another way to prevent infection by viruses of such type (the worms and viruses that use "Scriptlet.Typelib" security vulnerability). You need to remove file association for .HTA extension. To do this you have to follow these steps:
1. Double click "My Computer" icon on desktop.
2. In appeared window choose menu "View" -> "Options...".
3. On "File Types" tab in "Registered file types" listbox select "HTML Applicaton" item.
4. Click "Remove" button and confirm action.
5. Close options dialog box.

I-Worm.Unis.a

Description I-Worm.Unis.a

This is Internet worm spreading with emails (as attached file) and through IRC channels. The worm is also able to affect RAR archives, it appends its code to RAR archives contents.
The worm functionality is based on so-called "plugins". The main worm component (Win32 EXE file about 12K of length) that is sent with emails and to IRC channels is just a "loader" that connects to a Web page and gets more worm components (plugins) from there, and then executes them. So, the worm functionality is completely dependent on plugins. There are five plugins known at the moment.
There Web page address depends on worm versions. There are addresses known at the moment:
http://hyperlink.cz/benny/viruses/
http://shadowvx.com/benny/viruses/
All known worm components (main EXE file and plugins) are compressed with TeLoc Win32 PE EXE files compressor.
The worm code has many bugs and infected files halt the system in most of cases and fails to send its copies to Inet. So, the worm has very few chances to be discovered in-the-wild.
Main Component
When main worm EXE file is executed (from attached email file, for example), it stays in the system as a service (hidden application), copies itself to Windows system directory with the MSVBVM60.EXE name (do not mix it up with MSVBVM60.DLL Windows VisualBasic library) and registers this copy in Windows auto-run registry key:
SOFTWAREMicrosoftWindowsCurrentVersionRun
The worm then gets connection to "http://hyperlink.cz/benny/viruses" Web page (somewhere in Czech republic) or to another one (depending on worm version), gets its plugins from there (the plugins are listed in special file at that site) and stores them in Windows system directory with names:
MSVBVM6A.DLL
MSVBVM6B.DLL
MSVBVM6C.DLL
MSVBVM6D.DLL
e.t.c.
These plugins are encrypted by Windows RSA crypto library, so the worm first decrypts them and then activates.
The worm then "sleeps" for some time (randomly selected - up to 5 minutes), and repeats all that again.
The main worm component contains the text:
[I-Worm.Universe] by Benny/29A
"Payload" Plugins
This plugins depending on system timer calls one of three procedures:
1. Affects MS Explorer: it sets default start, local, "what's new" and search pages to "http://www.therainforestsite.com"
2. Gets the UNIVERSE.JPG file from worm's Web site and registers it as Windows desktop WallPaper.

3. Messes up the Desktop - randomly moves the blocks of it.
"Feedback" Plugin
This plugins reports about infected machine: it sends the report to email address which are different in different plugin's version:
benny_29a@hushmail.com
auto129742@hushmail.com
The report contains the Inet name of infected machine and the date&time of infection.
"Mail" Plugin
This plugins scans all HTML files in Internet cache directory, gets Inet addresses from there and sends messages to these addresses. The messages have the fields:
From: "Microsoft Support" [support@microsoft.com]
Reply-To: "Peter Szor" [pszor@symantec.com]
To: "Mikko Hypponen" [mikko.hypponen@f-secure.com]
Subject: Virus Alert
Attached file name: uniclean.zip
Text:

Dear user
F-Secure, Symantec and Microsoft, top leaders in IT technologies have discovered one very dangerous Internet worm called I-Worm.Universe in the wild. Author of this viral program is well known hacker from Europe under "Benny" nickname from 29A virus writting group.
Universe is fast-spreading worm that already destroyed computer systems in FBI and Microsoft. It is heavilly encrypted and very complex. It consists from many independed parts called "modules", which are very variable - every second hour is producted one new module, that completelly changes behaviour of worm, including anti-detection tricks.
You should check your system by our anti-virus attached to this mail. All reports please send to our mail address: universe@microsoft.com and/or universe@f-secure.com
Have a nice day,
F-Secure, Symantec and Microsoft, top leaders in IT technologies.
The attached file actually is worm main component (loader), not ZIP archive. If a victim user tries to open that file from email message a ZIP archiver will start and it will report about broken archive or wrong archive format. So the worm code will not be activated as a result under standard Windows installation.
"Mirc" Plugin
This plugin just drops to C:MIRC32 directory (if exists) new SCRIPT.INI file that contains the text:
;Default mIRC32 script
;** DO NOT EDIT **
and the instruction that sends worm "loader" to any user who enters infected IRC channel.
"Rar" Plugin
This plugins looks for all *.RAR archives in MS Explorer Download directory and writes itself with SETUP.EXE name to the archive.

Home