This is the first known Internet-worm in the Logo language that is widely used by schools worldwide. The worm itself is a LGP file, that is, a Logo Project File. It can be executed with special interpreter software like SuperLogo for Windows.
The worm doesn’t spread by itself; rather it drops two different components:
It also drops a BAT file that writes a message on the screen during Windows startup. The message is:
The worm creates a VBS file in a Windows startup folder, thus, it will be executed automatically upon the next Windows startup. The scripts in the VBS file create and send a message via Outlook to every entry in the address book. These messages have:
An MIRC script in the worm’s INI file is very short, and just sends the worm’s LGP file to all users joining an infected channel.
|Find out the statistics of the threats spreading in your region|