News

Virus alert: Beware Bill Clinton worm

Mike Simons
Users should check their e-mail inbox for a new worm masquerading as a Bill Clinton screensaver.

The Caric-A worm promises an animation of the former US president and can be identified by the subject line "bill caricature" and the attached file "cari.scr".

Opening the file causes a picture to appear on the screen and triggers a mechanism that forwards the e-mail to anyone listed in a victim's address book.

The worm itself is a Windows PE EXE file about 11Kb in length, written in Visual Basic.

According anti-virus vendor Kapersky Labs, once installed in the system (after Windows reboot following infection) the worm checks the current date, if the current hour value is eight, the worm executes its payload routine, deleting the following files:

  • c:\*.*

  • d:\*.*

  • e:\*.*

  • f:\*.*


It also deletes .sys files in the Windows directory and .vxd, .sys, .ocx, and .nls files in the Windows system directory.

Natasha Staley, anti-virus consultant at Sophos, said the worm should not prove a threat to organisations and individuals who have learned the lessons of mass mailer worms from the Love Bug onwards. "Those practising safe computing should not be caught out," said Staley.

Email Alerts

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
 

COMMENTS powered by Disqus  //  Commenting policy