Email-Worm.JS.Gigger

Technical Details

This is a dangerous worm. It replicates using Outlook, Outlook Express
and mIRC. The worm is written in JavaScript and Visual Basic Script (VBS).
It contains destructive payload routines that are able to format the
user’s hard disk after reboot, and can delete all files on all available
disks.

Installation

While installing into the system, the worm creates several files:

C:Bla.hta
C:B.htm
C:WindowsSamplesWshCharts.js
C:WindowsHelpMmsn_offline.htm

Then the worm finds its “already infected” sign in the registry, and if
it doesn’t exist, the worm creates it.

The infection presence sign is located in the following registry key:

HKEY_CURRENT_USERSoftwarethegravebadusersv2.0

The worm finds all connected network drives and copies itself to them to
the following location:

WindowsStart MenuProgramsStartUpMsoe.hta

Spreading via e-mail

The worm uses Outlook and Outlook Express to spread in infected e-mail
messages.

Infected message contain the following properties:

Subject: Outlook Express Update
Body: MSNSoftware Co.
Attachment: mmsn_offline.htm

The worm also sends a message that contains the e-mail addresses of its
recipients to an e-mail address, which seems to belong to the worm’s
author.

Spreading via IRC

The worm finds the installation folder of an mIRC client application, and
creates there the file name “script.ini”.
After this, the worm sends itself to each user that joins the same IRC
channel where the infected user is.

Filename sent through mIRC: “mmsn_offline.htm”

Payload

The worm adds the following line in the file Autoexec.bat:

ECHO y|format c:

This results in formatting disk C: upon computer restarting.

If the day of the month is the 1st, 5th, 10th, 15th or 20th, the worm deletes all files
from all drives.