|
|
To print: Select File and then Print from your browser's menu
-------------------------------------------------------------- This story was printed from ZDNet Australia. --------------------------------------------------------------
|
Maldal.I: The spawn of Zacker strikes again By Robert Vamosi, 0 February 25, 2002 URL: http://www.zdnet.com.au/news/security/soa/Maldal-I-The-spawn-of-Zacker-strikes-again/0,130061744,120263669,00.htm
Another member of the Maldal worm family makes its début on the Internet. Yet another variation of the prolific Maldal virus family is loose on the Internet. Maldal.I (w32.maldal.i@mm) is written in Visual Basic and is 23,552 bytes long. Like its cousin Reeezak, this latest version retards your system's overall performance by producing excess files on your hard drive. Because Maldal.I sends e-mail and does not delete data on infected computers, this worm ranks a 4 on the ZDNet Virus Meter.
How it works
Fwd: Remember our survivors
The body of the e-mail is blank, and the attached file can be program.exe, (system name).pif, or (random name).pif. If the attached file is opened, Maldal.I first reads e-mail addresses from Web pages cached on the infected user's hard drive as well as from the Microsoft Outlook address book, then send out copies of itself. Maldal.I then displays a black background and red text on the desktop that reads: "Sorry you have not registered Please contact us (phone numbers, email addresses and instructions on how to subscribe follows)." Maldal.I creates several new entries, adding ZaCker.pif to the Windows and System directory and hide.pif to the Windows directory. Additionally, Maldal.I will add .pif to every file that matches its directory name, so within Windows, there will be a file named Windows.pif. The worm then creates several entries in the Registry Run key that point to infected files all over the hard drive. The name of the value is equal to the directory that the PIF file was inserted in. For example, the added System \ system.pif file would be added to the Registry as Hklm \Software \Microsoft \Windows \ CurrentVersion \ Run system = "System\system.pif". Five minutes after being run, the worm may display a black background with the following text in red letters: ZaCker Is N YoUr MaChiNe
Prevention
Removal
Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved. |
