|
|
|
Top 10 malware reported to Sophos in August 2000
This section helps you to understand how it behaves
This worm spreads via Microsoft Outlook email and over IRC using mIRC or
Pirch.
The mIRC element of this worm is detected by Sophos Anti-Virus as
mIRC/Stages-A and the Pirch element is detected as pIRC/Stages-A.
Via email, the worm sends a message whose subject is constructed from the
following terms: "Fw:", "Life Stages", "Funny", "Jokes" and " text".
The body of the message may contain the text "The male and female stages of
life."
The worm itself is attached as a file called LIFE_STAGES.TXT.SHS. When it
runs, the worm displays the following text:
- The male stages of life:
Age. Seduction lines.
17 My parents are away for the weekend.
25 My girlfriend is away for the weekend.
35 My fiancee is away for the weekend.
48 My wife is away for the weekend.
66 My second wife is dead.
Age. Favorite sport.
17 Sex.
25 Sex.
35 Sex.
48 Sex.
66 Napping.
Age. Definiton of a successful date.
17 Tongue.
25 Breakfast.
35 She didn't set back my therapy.
48 I didn't have to meet her kids.
66 Got home alive.
- The female stages of life:
Age. Favourite fantasy.
17 Tall, dark and hansome.
25 Tall, dark and hansome with money.
35 Tall, dark and hansome with money and a brain.
48 A man with hair.
66 A man.
Age. Ideal date.
17 He offers to pay.
25 He pays.
35 He cooks breakfast next morning.
48 He cooks breakfast next morning for the kids.
66 He can chew his breakfast.
It then attempts to create copies of itself on all available network drives.
It also moves the regedit.exe to the recycled folder and changes its name to
recycled.vxd.
|
|
|
This webpage is optimized for 800 x 600 monitor resolution or above and
the latest web browser. |
|
|
