|
|
VBS/Coolnot.A Worm Information
Name: VBS/Coolnot.A
Aliases: CoolNotepad
Type: Worm
Date: May 30, 2000
Description:
A Visual Basic script worm, VBS/Coolnot.A uses the Outlook address book and mIRC to spread. The worm drops a copy of itself to C:\Windows\System\Cool_notepad_demo.txt.vbs and modifies the registry to run at startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Cool_notepad_demo.txt.vbs
VBS/Coolnot.A attempts to automatically connect to #virus during chat connects and sends a copy of itself to others on the channel. It also exploits the Outlook address book, sending itself to all recipients therein. The email message appears as follows:
Subject: "Cool Notepad Demo"
Body: "Hey check out this text file I sent.
It will do something neat in notepad. Enjoy :-)"
There is no malicious payload, though as with any email spamming worm, mail servers may suffer congestion-related problems if the worm should become widespread.
Detection:
Command AntiVirus v4.58.3 and deffiles dated 05/30/00 provide detection and disinfection for this worm.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Home · Purchase Center · Virus Center · Support Center
|
|
|
