White Papers

Red Alert: I-Worm.Updater / UPDATE.VBS (Kaspersky)

• Tags:
• worm,
• outlook,
• attached,
• malicious

Overview Date: Thursday, December 06, 2001

Name: I-Worm.Updater

Kaspersky Labs reports the detection of the latest Internet worm, I-Worm.Updater. At this time, several reports of infection by this malicious code have been reported.

Updater is written in Visual Basic Script, and the worm itself is an EXE file about 12Kb in length, compressed in a UPX utility.

The worm spreads via e-mail by gaining access to the Outlook address book. The worm, unbeknownst to a user, sends infected messages to all addresses found in Outlook.

This is a virus-worm that spreads via the Internet attached to infected e-mails. The worm itself is a Windows PE EXE file about 12Kb in length, and it is written in Visual Basic (VB6). It is packed by the UPX program. After unpacking, it is 45 Kb in size.

The worm activates from an infected e-mail only when a user clicks on an attached file. The worm then installs itself to the system, runs a spreading routine and payload.

The infected messages have different texts and attached file names, they are randomly selected by the worm while spreading from the [a set of] variants.

Updater has some troublesome side effects. The worm creates a malicious script progrm, UPDATE.VBS, copies the program to the Windows autoloading catalogue, and releases it upon completion. This program searches for files with .EXE, .DOC, and .VBS extentions on disks, and creates a file companion for them containing the worm's copy. These file companions have the same names as the original files, plus a "second" .VBS extension.

• 
• Did you find this white paper useful? 1 out of 3 users found this white paper useful

• Subscribe to the IT White Papers Newsletter
• White Paper RSS