I-Worm.Xana
Details
I-Worm.Xanax
This is an Internet worm that was found in the wild in the middle of March 2001. The worm spreads via e-mail by sending infected messages from affected computers through IRC channels by sending its copy there. The worm also infects EXE files in the Windows directory.
The worm itself is a Win32 application (PE EXE file) written in Microsoft Visual C++ language. The worm size is about 60K in length, but it was found in compressed form: the worm code was compressed by ASPack utility, possessing about 34K in length.
When the worm starts, it copies itself to the Windows system directory with two names: XANAX.EXE and XANSTART.EXE. The XANSTART.EXE file is then registered in Registry auto-run key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Default = %winsystem%\xanstart.exe
where %winsystem% is the name of the Windows system directory. As a result, the worm is run each time Windows starts up.
Infected E-mail
The worm then launches its e-mail spreading routine. To do this, the worm creates a temporary XANAX.VBS file (Visual Basic script), writes a VBS program there and starts it with the help of WSCRIPT.EXE. The VBS program gains access to the Outlook address book, and sends messages to the first 1,000 addresses from each of the address lists
Subject: Stressed? Try Xanax!
Body:
Hi there! Are you so stressed that it makes you ill? You’re not alone!
Many people suffer from stress, these days. Maybe you find Prozac too
strong? Then you NEED to try Xanax, it’s milder. Still not convinced?
Check out the medical details in the attached file. Xanax might change
your life!
Attachments: xanax.exe
Infecting EXE files
The worm then looks for EXE files in the Windows directory, and infects them. While infecting, the worm moves a victim file body down and writes itself to the file beginning. The worm does not infect files with names beginning with E, P, R, S, T, W.
IRC channels
Next, the worm infects the mIRC client if it is installed. The worm looks for the mIRC client in the following directories:
\mirc
\Program Files\mirc
on the C:, D:, E: and F: drives. If the mIRC client exists, the worm overwrites the SCRIPT.INI mIRC script file with a program that sends the worm’s copy to everybody who joining the infected channel.
Other Comments
When the worm is run from a file with name with the letter ‘R’ as the next to last one in a file name (xxxRx.EXE), it displays the following message:
The exact name as this contains the worm’s file XANSTART.EXE that is registered in the system Registry auto-run key. So, the worm displays this message upon each Windows start-up.
The worm also creates more files in the system:
Windows system directory: HOSTFILE.EXE
Windows directory: WINSTART.BAT, XANAX.SYS
The HOSTFILE.EXE remains after running an infected host file, and this file contains a pure (not infected) body of last infected file run.
The XANAX.SYS file contains the text:
Win32.HLLP.Xanax (c) 2001 Gigabyte
The WINSTART.BAT file contains commands that display the message:
Do not take this medication with ethanol, Buspar (buspirone), TCA antidepressants, narcotics, or other CNS depressants. This combination can increase CNS depression. Be sure not to take other sedative, benzodiazepines, or sleeping pills with this drug. The combinations could be fatal. Do not smoke or drink alcohol when taking Xanax. Alcohol can lower blood pressure and decrease your breathing rate to the point of unconsciousness. Tobacco and marijuana smoking can add to the sedative effects of Xanax.
Related Posts