Email-Worm.Win32.Melting

Technical Details

This is a virus-worm that spreads via the Internet. The worm itself is a Win32 PE
EXE file about 18Kb in length, and it is written in VisualBasic. It is
transferred via the net in e-mail messages with infected attachments with the
“MeltingScreen.exe” name.

When an infected message is received and the attached EXE file is executed,
the worm gains control and starts its spreading routine. This routine
connects to MS Outlook, enters the address book, obtains Internet addresses from
there and sends messages by using these addresses.

The messages have a copy of the worm in the attachment with the Subject “Fantastic
Screensaver”, and the message body appears as follows:

 Hello my friend !
 Attached is my newest and funniest Screensaver, I named it MeltingScreen. 
 Test it and tell me what you think.
 Have a nice day my friend.
 p.s.: Please install the Runtime Library for VB 5.0, before you run the ScreenSaver.

The worm then gains access to the Windows directory and renames all EXE files
there with a BIN extension.

The worm has bugs and often hangs a computer when run.

The worm actually has screen-saver ability. After spreading and renaming
EXE files to BIN, it “melts” the screen.