This is a family of Internet worm that spread via e-mail by sending infected messages from infected computers. While spreading, the worms use MS Outlook and send themselves to all addresses that are stored in the MS Outlook Address Book. As a result, an infected computer sends as many messages to as
There are two worm variants known. Both have bugs in their code and are not able to spread, but these bugs can be easily fixed by a hacker.
The worms are written in the scripting language “Visual Basic Script” (VBS), and they work only on computers on which the Windows Scripting Host (WSH) is installed. In Windwos 98 and Windows 2000, WHS is installed
The worm arrives to a computer as an e-mail message with an attached VBS file that is the worm itself. The message in the original worm version contains:
Depending on system settings, real extension of an attached file (“.vbs”) may not be shown. In this case, the filename of the attached file is displayed as “COOL_NOTEPAD_DEMO.TXT”.
Upon being activated by a user (by double clicking on the attached file), the worm dispalys the following message:
Then it creates a shortcut on the desktop to a PIF-file that exits Windows. The worm sets a shortcut icon to a non-existing file, so the shortcut has a standard icon – a windows flag with white background. After this, the worm displays the following message:
Then the worm begins speading – it opens MS Outlook, gets access to the Address Book, gets all addresses from there and sends messages with its attached copy to all of them. The message subject, body and attached file name are the same as above.
The worm also installs itself into the system. It creates its copy in the Windows directory with the “Prinz_Charles_Are_Die.TXT.vbs” name:
This file is then registered in the Windows auto-run section in the system registry:
As a result the worm is re-activated each time Windows boots up.
The worm itself is a text script program, and it is spread in text source form. The worm’s code may be easily modified by hackers, and as a result, there are many variants of the worm that may have appeared. Usually only minor changes are
This worm variant is very close to the first one. Upon being activated, it displays other messages:
The infected message contains: