White Papers

W32.Maldal.D@mm (Symantec)

• Tags:
• machine,
• book,
• name,
• files

Overview Name: W32.Maldal.D@mm

Discovered on: December 29, 2001
Last Updated on: December 29, 2001 at 10:30:56 PM PST

W32.Maldal.D@mm was written and distributed on December 28th of 2001. The virus code is in Visual Basic. It is about 27KB in size packed with Aspack. The worm utilizes Outlook to spread itself to everybody in the Outlook address book.

Threat Assessment: Medium

Threat containment: Easy

Removal: Easy

Payload: Large scale e-mailing: Utilizes Outbook to mail everyone in the Outlook Address Book Deletes files: Attempts to delete antivirus software and files with the following extensions: .INI, .PHP, .EXE, .COM, .MPEG, .DAT, .ZIP, .TXT, .EXE, .XLS, .DOC,.JPG.

Causes system instability: Critical system files may have been deleted

Subject of email: ZaCker
Name of attachment: Name of infected
computer from which the worm
was sent.exe or ZaCker.exe

Size of attachment: 27Kbytes

Technical description: When executed the first time the worm will install itself as win.exe in the WINDOWS\SYSTEM directory. It will also add a registry entry modifing the RUN field by adding an entry named "system" that will point to the WIN.EXE file. This is to load the worm a second time. However in the majority of the cases the machine can not boot after the worm has been executed as explained later.

After this it will get the name of the machine. This is because the worm wants to send mails with a subject line that has the name of the computer. The actual attachment in the mail is an EXE file, the worm itself with the name of the machine such as mypc.exe. If executed again, the worm will use a subject "ZaCker" and an attachent called ZaCker.exe. This is because the worm renames the computer to "ZaCker".

Click through to the alert text for disinfection information.

• 
• Did you find this white paper useful?

• Subscribe to the IT White Papers Newsletter
• White Paper RSS