Kaspersky Labs Int., the Russian leader in the development of anti-virus safety systems, reports the detection of the latest Internet worm "in the wild" known as "I-Worm.Scrapworm (VBS/Stages)", spreading itself basically via e-mail with the help of MS Outlook. In addition to this, the current worm...
Kaspersky Lab Int., the Russian leader in the development of anti-virus safety systems, reports the detection of the latest Internet worm "in the wild" known as "I-Worm.Scrapworm (VBS/Stages)", spreading itself basically via e-mail with the help of MS Outlook. In addition to this, the current worm has the ability to spread itself via IRC, using either mIRC or Pirch. Here is a list of the following aliases of this Internet worm:
IRC/Stages.worm, IRC/Stages.ini, LIFE_STAGES.TXT.SHS, ShellScrap Worm, VBS/LifeStages, VBS/Stages.14558, VBS/Stages.2542, VBS/Stages.worm, VBS_STAGES
The author of the virus, the malefactor going by the name of ZULU, released his creation "I-Worm.Scrapworm" at the author's site last week. In a matter of a few days, this worm was detected "in the wild" in practically all the countries of the world. As harmless as it may seem, the worm has shown just how dangerous it can be during spreading.
General Characteristics:
Via e-mail, the virus sends a message, the theme of which could be a combination of the following lines: [S1]+[S2]+[S3]:
S1 : "FW: ", "",
S2: Life stages", "Funny", "Jokes"
S3 : " text", ""
Take the following example:
"Funny"
"FW: Jokes text"
"Life stages"
The sender's address is shown in the field BCC (invisible copy).
The body may be of three variations:
blank
"The male and female stages of life."
"The male and female stages of life. Bye."
The virus itself is attached to the letter as a file with the name:
"LIFE_STAGES.TXT.SHS".
Destructive Activity:
Upon starting, the worm creates a file in time on the disk named "LIFE_STAGES.txt," and depicts its contents with the help of the text editor. The text contains a long and amusing text on life (that is according to the author):- The male stages of life:
Age. Seduction lines.
17 My parents are away for the weekend.
25 My girlfriend is away for the weekend.
35 My fiancee is away for the weekend.
48 My wife is away for the weekend.
66 My second wife is dead.
Age. Favorite sport.
17 Sex.
25 Sex.
35 Sex.
48 Sex.
66 Napping.
Age. Definiton of a successful date.
17 Tongue.
25 Breakfast.
35 She didn't set back my therapy.
48 I didn't have to meet her kids.
66 Got home alive.
- The female stages of life:
Age. Favourite fantasy.
17 Tall, dark and hansome.
25 Tall, dark and hansome with money.
35 Tall, dark and hansome with money and a brain.
48 A man with hair.
66 A man.
Age. Ideal date.
17 He offers to pay.
25 He pays.
35 He cooks breakfast next morning.
48 He cooks breakfast next morning for the kids.
66 He can chew his breakfast.
Simultaneously, the worm creates copies under the happenstance name on the local and hooked up network disk. In addition, the virus transfers regedit.exe to the basket while changing its name to � recycled.vxd.
The processes of detection and treatment of "I-Worm.Scrapworm" have been added to the latest update of the anti-virus database AntiViral Toolkit Pro (AVP). An update is available at the Kaspersky Lab web-site www.kasperskylabs.com
