Details
I-Worm.Ivalid

This is a dangerous worm that spreads via the Internet attached to e-mail messages. The worm itself is a Windows application about 12K in size. To spread, the worm uses SMTP and connects to the “mail.bezeqint.net” e-mail server in order to send infected messages.
The worm obtains a victim’s e-mail addresses from HTML files. It searches for *.HT* files on the hard drive and looks for e-mail addresses there.
The infected messages contain the following data:
From: “Microsoft Support” [support@microsoft.com]
Subject: Invalid SSL Certificate’,0Dh,0Ah
Attach: SSLPATCH.EXE

Message text:
Hello,
Microsoft Corporation announced that an invalid SSL certificate that web sites use is required to be installed on the user computer to use the https protocol. During the installation, the certificate causes a buffer overrun in Microsoft Internet Explorer and by that allows attackers to get access to your computer. The SSL protocol is used by many companies that require credit card or personal information so, there is a high possibility that you have this certificate installed.
To avoid of being attacked by hackers, please download and install the attached patch. It is strongly recommended to install it because almost all users have this certificate installed without their knowledge.
Have a nice day, Microsoft Corporation
In case of an error, or when infected messages are sent, the worm encrypts all EXE files the in current and all parent directories. While encrypting, the worm uses standard Windows crypto API.
The worm also contains the following texts in its body:
I-Worm.Invalid, Written By Dr.T/BCVG Network, 2001
The Black Cat Virii Group, 2001

Details
I-Worm.Icecubes.a

This is an Internet worm that spreads as an attachment via e-mail. The worm itself is a Windows executable file about 18Kb in length. Upon being executed from an e-mail attachment, the worm installs itself to the system and hides its activity utilizing a humerous dialogue box that “configures” Windows icecubes.

While installing, the worm copies itself to the Windows system directory with WSOCK2.DLL name (note: not WSOCK32.DLL, not WSOCK2.VXD), and infects the original WSOCK32.DLL Windows library by writing its code to the end of the file. This library is usually locked by Windows for writing, and the worm uses a standard stick: it copies that file with a WSOCK32.INF name, infects this copy, and writes a “rename” command to the WININIT.INI file, which in turn will replace the original WSOCK32.DLL with an infected one upon the next Windows restart.
The worm code in the infected WSOCK32.DLL hooks the “send” function, and monitors all data that are sent. When a message is outgoing, the worm duplicates it with a second message with an attached ICECUBES.EXE file and:
Subject: Windows Icecubes !
Text:
I almost forgot. Look at what I found on the web. This tool scans your system for hidden Windows settings, better known as -Windows Icecubes-. These secret settings were built in by the Windows programmers. I think you might want to change them a little, just take a look !
The worm also logs Internet login names and passwords to a ICECUBE.TXT file in the Windows directory.
On July 1st, the worm displays the following message:
W9x.Icecubes / f0re [lz0]

Windows detected icecubes on your harddrive.
This may cause the system to stop responding.
Do you want Windows to remove all icecubes ?

Details
I-Worm.Hybris.a

This is an Internet worm that spreads attached to e-mail messages. The worm works under Win32 systems only. The worm contains components (plugins) in its code that are executed depending on the worm’s needs, and these components can be upgraded from an Internet Web site.
The major worm versions are encrypted with a semi-polymorphic encryption loop.
The worm contains the text strings:
HYBRIS
(c) Vecna
The Worm Runs
The main worm target on a computer is the WSOCK32.DLL library. While infecting this file, the worm:
writes itself to the end of the last file section
hooks “connect”, “recv”, and “send” functions
modifies the DLL entry routine address (a routine that is activated when a DLL file is being loaded) and encrypts the original entry routine
If the worm is not able to infect WSOCK32.DLL (in case it is in use and is locked for writing), the virus creates a copy of that library (a copy of WSOCK32.DLL with random name), infects it and writes a “rename” instruction to WININIT.INI file. As a result, WSOCK32.DLL will be replaced with an infected image upon the next Windows startup.
The worm also creates its copy with a random name in the Windows system directory and registers it in the RunOnce registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce {Default} = %WinSystem%\WormName
or
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce {Default} = %WinSystem%\WormName
where %WinSystem% is the Windows system directory, and “WormName” is a random eight symbols name, for example:
CCMBOIFM.EXE
LPHBNGAE.EXE
LFPCMOIF.EXE
There is only possible reason for registering an additional worm copy in the “RunOnce” registry key: in case WSOCK32.DLL was not infected during the first worm run, and its infected copy was not created because of some reason, the “RunOnce” worm copy will complete the task upon the next Windows restart.
Infected WSOCK32.DLL
The worm intercepts Windows functions that establish a network connection, including the Internet. The worm intercepts data that are sent and received, and scans them for e-mail addresses. When an address(es) is/are detected, the worm waits for some time and then sends an infected message to that/those address(es).
Plugins
The worm’s functionality depends on the plugins that are stored in worm body encrypted with a RSA-like strong crypto algorithm with a 128-bit key. There are up to 32 plugins that can be found in different worm versions. These plugins perform different actions that can be updates from a Web page:
http://pleiku.vietmedia.com/bye/
so the complete worm functionality depends only on its host that is able to upgrade plugins on a Web page. The plugins on a page are encrypted with RSA-like crypto too.
The worm also updates its plugins by the using alt.comp.virus newsgroup. The worm, being active on a machine, connects to a news server (by using one of randomly selected servers - there are more than 70 addresses in the list), converts its plugins to newsgroup messages and posts them there. The Worm’s messages have a random-like Subject, for example:
encr HVGT GTeLKzurGbGvqnuDqbivKfCHWbizyXiPOvKD
encr CMBK bKfOjafCjyfWnqLqzSTWTuDmfefyvurSLeXGHqR
text LNLM LmnajmnKDyfebuLuPaPmzaLyXGXKPSLSXWjKvWnyDWbGH
text RFRE rebibmTCDOzGbCjSZ
where first four chores are plugin “name” and following four chores are an encoded plugin “version”. As well as sending, the worm reads such messages from alt.comp.virus, obtains the plugin “name” and “version” and compares them with plugins that are currently used by the worm. In case the newsgroup has a message with a higher plugin version, the worm extracts it and replaces the existing one. So the worm uses alt.comp.virus to upgrade its plugins.
The worm also creates these plugins as disk files in the Windows system directory. They also have a random name, but the worm keeps being able to access them. The names may look as follow:
BIBGAHNH.IBG
DACMAPKO.ACM
GAFIBPFM.AFI
IMALADOL.MAL
MALADOLI.ALA
There are several different known plugins that:
1. Infect all ZIP and RAR archives on all available drives from C: till Z:. While infecting, the worm renames EXE files in the archive with a .EX$ extension and adds its copy with a .EXE extension to the archive (companion method of infection).
2. Send messages with encoded plugins to the “alt.comp.virus” neewsgroup, and obtains new plugins from there.
3. Spread virus to remote machines that have a SubSeven backdoor Trojan installed. The plugin detects such machines on the Net, and using SubSeven commands, uploads a worm copy to the machine and spawns it in there.
4. Encrypt worm copies with a polymorphic encryption loop before sending the copy attached to an e-mail.
5. Depending on system date and time (on September 16 and 24, and on 59 minute of each hour starting from year 2001 - in known plugins) the “spirale” effect is run.
The plugin creates random 8-bytes .EXE name in Windows system directory, unpacks “spirale effect” EXE code to there, and registers that file in the system:
under Win9x: in WIN.INI file in [windows] “run=” line under WinNT: in system registry in “Run=” key
6. Affects DOS EXE and Windows PE EXE files. The worm affects them so that they become to be worm droppers. When run they drop worm EXE file to TEMP directory and execute it.
While affecting DOS EXE file the plugin adds dropper code and worm body to the end of the file. These files are disinfectable.
While affecting Windows PE EXE file the plugin overwrites file code section to get a gap for worm code, and writes worm dropper code to that gap (if is has enough size). The plugin doesn’t touch file header (including entry point address), and does not increase file size. Moreover, it has a anti-CRC (chechsum) routine that fill special data in plugin code so that file CRC becomes the same for few common used CRC algorithms. That means, that some integrity checkers will not detect changes in affected files: the file length and file body CRC stay the same as on clean file.
When such PE EXE file is run, the dropper code drops and activates the worm, then restores (unpacks) code section and returns control to the host file.
7. Randomly select a Subject, Message text and Attach name while sending the worm copies with e-mail messages:
From:
Hahaha [hahaha@sexyfun.net]
Subjects:
Snowhite and the Seven Dwarfs - The REAL story!

Branca de Neve porn?!
Enanito si, pero con que pedazo!
Les 7 coquir nains
Message texts:
C’etait un jour avant son dix huitieme anniversaire. Les 7 nains, qui avaient aidù ‘blanche neige’ toutes ces annùes aprøs qu’elle se soit enfuit de chez sa belle møre, lui avaient promis une *grosse* surprise. A 5 heures comme toujours, ils sont rentrùs du travail. Mais cette fois ils avaient un air coquinall
Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter…
Faltaba apenas un dia para su aniversario de de 18 aTos. Blanca de Nieve fuera siempre muy bien cuidada por los enanitos. Ellos le prometieron una *grande* sorpresa para su fiesta de compleaTos. Al entardecer, llegaron. Tenian un brillo incomun en los ojos…
Faltava apenas um dia para o seu aniversario de 18 anos. Branca de Neve estava muito feliz e ansiosa, porque os 7 an¿es prometeram uma *grande* surpresa. As cinco horas, os an¿ezinhos voltaram do trabalho. Mas algo nao estava bem… Os sete an¿ezinhos tinham um estranho brilho no olhar…
Attach names:
enano.exe
enano porno.exe
blanca de nieve.scr
enanito fisgon.exe
sexy virgin.scr
joke.exe
midgets.scr
dwarf4you.exe
blancheneige.exe
sexynain.scr
blanche.scr
nains.exe
branca de neve.scr
atchim.exe
dunga.scr
anóo porn?.scr
As well as (depending on the plugin version):
The message Subject is a random combination of:
Anna + sex
Raquel Darian sexy
Xena hot
Xuxa hottest
Suzete cum
famous cumshot
celebrity rape horny
leather … e.t.c.

Attach name:
Anna.exe
Raquel Darian.exe
Xena.exe
Xuxa.exe
Suzete.exe
famous.exe
celebrity rape.exe
leather.exe
sex.exe
sexy.exe
hot.exe
hottest.exe
cum.exe
cumshot.exe
horny.exe
anal.exe
gay.exe
oral.exe
pleasure.exe
asian.exe
lesbians.exe
teens.exe
virgins.exe
boys.exe
girls.exe
SM.exe
sado.exe
cheerleader.exe
orgy.exe
black.exe
blonde.exe
sodomized.exe
hardcore.exe
slut.exe
doggy.exe
suck.exe
messy.exe
kinky.exe
fist-fucking.exe
amateurs.exe
The attached file name may also be a random eight bytes .EXE name, for example:
ADELHHAD.EXE
CFIMMHAG.EXE
DIEOPIDI.EXE
EABLLNEA.EXE
FKPODKFK.EXE
HJEOINHJ.EXE
OGNNFEOG.EXE
PFFCKEPF.EXE

Details
I-Worm.Hunch.a

This is a virus-worm that spreads via the Internet attached to infected e-mail. The worm itself is a Windows PE EXE file about 151 Kb in length, and it is written in Visual Basic.
Infected messages appear as follows:
Subject: COSTO
Body: Mensaje importante para %Recipient% en el archivo adjuntoall
(%Recipient% is the full name of the recipient.
Attachment: PE EXE file with a random name.

Installing
When the worm is launched, it creates a window containing a picture,

and installs into the system. When installing into the system, the worm copies itself to three files in the Windows system directory: one with the original name of the file, from which the worm has been launched and the following names:
%SYSTEM%\THWIN.EXE
%SYSTEM%\MSWORD.EXE
Then, the worm writes the following registry keys to start automatically with Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices THWIN=%SYSTEM%\THWIN.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\Run THWIN=%SYSTEM%\THWIN.EXE
The worm also tries to copy itself to the A: drive with the “UNSCH.JPG.EXE” name.
Replication: e-mail
The worm uses Microsoft Outlook to send infected messages. The worm extracts e-mail addresses from the MS Outlook Address Book and sends itself to these addresses.
Payload
Depending on the worm’s internal counters, the worm writes disk a C: formatting command to the C:\Autoexec.bat file.

Details
I-Worm.Horillka

This malicious worm spreads via the Internet in the form of a file attached to infected messages. It is an encoded VBS script of 25562 bytes.
When downloaded Horilka decrypts itself.
It copies itself to the Windows system directory under the name WinSys32dll.vbs, and registers this file in the system registry autorun key.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinSys32dll.
The virus mass mails all addresses found in the Microsoft Outlook address book.
Characteristics of infected messages:
Message header:
÷ÎÉÍÁÎÉÅ!
Message body:
÷ÙÐÕÝÅÎÏ ÎÏ×ÏÅ vbs ÏÂÎÏ×ÌÅÎÉÅ ÄÌÑ ÐÏÉÓËÁ ×ÉÒÕÓÏ× × ÐÁÍÑÔÉ ïó Windows!
ïÎÏ ÐÏÍÏÇÁÅÔ ÂÏÒÏÔØÓÑ Ó ×ÉÒÕÓÁÍÉ, ÒÁÓÓÙÌÁÀÝÉÍÉÓÑ ÐÏ ÐÏÞÔÅ.
áÎÔÉ×ÉÒÕÓÎÙÊ ÍÏÄÕÌØ ÎÁÐÉÓÁÎ ÎÁ ÓËÒÉÐÔ-ÑÚÙËÅ, ÞÔÏ ÐÏÍÏÇÁÅÔ ÐÅÒÅÈ×ÁÔÙ×ÁÔØ
vb É js ×ÉÒÕÓÙ, ÐÒÅÖÄÅ ÞÅÍ ÏÎÉ ÎÁÞÎÕÔ ÄÅÓÔÒÕËÔÉ×ÎÕÀ ÄÅÑÔÅÌØÎÏÓÔØ.
äÏÓÔÁÔÏÞÎÏ ÏÔËÒÙÔØ ÆÁÊÌ É ÐÒÏÇÒÁÍÍÁ ÐÏ ÕÓÔÒÁÎÅÎÉÀ ×ÉÒÕÓÏ× ÐÒÏ×ÅÄÅÔ ÐÏÉÓË
×ÒÅÄÏÎÏÓÎÙÈ ÐÒÏÇÒÁÍÍ × ÐÁÍÑÔÉ ËÏÍÐØÀÔÅÒÁ.
Attachment:
a VBS script,
WinSys32.dll.vbs
Once messages have been sent, the virus sends its author a message which includes all .pwl (password) files found in the Windows directory.
Messages are sent once, when each user’s configuration is loaded.
The virus copies itself to all disks and all directories under the name of Folderdll.vbs and marks these files as hidden.
It searches the Windows folder for files with the following extensions:
.vbs
.jpg
.jpeg
.gif
.bmp
.htm
.html
.avc
.txt
.doc
.mp3
.wav
.dbf
Horilka overwrites .vbs files with its own code.
It replaces .jpg, .jpeg, .gif and .bmp files with a GIF format graphic contained in the body of the virus.
It adds the following code to .htm and.html files: