Virus alert: Beware Bill Clinton worm


Virus alert: Beware Bill Clinton worm

Mike Simons
Users should check their e-mail inbox for a new worm masquerading as a Bill Clinton screensaver.

The Caric-A worm promises an animation of the former US president and can be identified by the subject line "bill caricature" and the attached file "cari.scr".

Opening the file causes a picture to appear on the screen and triggers a mechanism that forwards the e-mail to anyone listed in a victim's address book.

The worm itself is a Windows PE EXE file about 11Kb in length, written in Visual Basic.

According anti-virus vendor Kapersky Labs, once installed in the system (after Windows reboot following infection) the worm checks the current date, if the current hour value is eight, the worm executes its payload routine, deleting the following files:

  • c:\*.*

  • d:\*.*

  • e:\*.*

  • f:\*.*

It also deletes .sys files in the Windows directory and .vxd, .sys, .ocx, and .nls files in the Windows system directory.

Natasha Staley, anti-virus consultant at Sophos, said the worm should not prove a threat to organisations and individuals who have learned the lessons of mass mailer worms from the Love Bug onwards. "Those practising safe computing should not be caught out," said Staley.

Email Alerts

Register now to receive IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

COMMENTS powered by Disqus  //  Commenting policy