TechTarget

Virus alert: Beware Bill Clinton worm

Users should check their e-mail inbox for a new worm masquerading as a Bill Clinton screensaver.

Users should check their e-mail inbox for a new worm masquerading as a Bill Clinton screensaver.

The Caric-A worm promises an animation of the former US president and can be identified by the subject line "bill caricature" and the attached file "cari.scr".

Opening the file causes a picture to appear on the screen and triggers a mechanism that forwards the e-mail to anyone listed in a victim's address book.

The worm itself is a Windows PE EXE file about 11Kb in length, written in Visual Basic.

According anti-virus vendor Kapersky Labs, once installed in the system (after Windows reboot following infection) the worm checks the current date, if the current hour value is eight, the worm executes its payload routine, deleting the following files:

  • c:\*.*

  • d:\*.*

  • e:\*.*

  • f:\*.*


It also deletes .sys files in the Windows directory and .vxd, .sys, .ocx, and .nls files in the Windows system directory.

Natasha Staley, anti-virus consultant at Sophos, said the worm should not prove a threat to organisations and individuals who have learned the lessons of mass mailer worms from the Love Bug onwards. "Those practising safe computing should not be caught out," said Staley.

CW+

Features

Enjoy the benefits of CW+ membership, learn more and join.

Read more

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCIO

SearchSecurity

SearchNetworking

SearchDataCenter

SearchDataManagement

Close