Class Email-Worm
Platform Win32

Technical Details

This worm spreads as an attachment to infected messages. When executed, the worm sends infected messages to all addresses stored in the MS Outlook address book, then it overwrites all HTML files on the local disk drives. When Windows is started again, the worm tries to delete all files in the Windows folder, and reboots the victim machine.

The worm arrives as an executable file attachment. The attachment contains the the worm itself. Infected messages contain the following:

The worm is only activated if the user starts it manually by double-clicking on the attachment.

When executed, the worm sends infected messages to all addresses stored in the Outlook address book. Then it attempts to open two Internet browsers at sites that have now been closed. Also, it replaces the Internet Explorer start-up page with one of its own. Following this, the worm drops two different VBS files.

The first one is named “MixDaLaL.vbs” that the worm creates and runs immediately in the Windows folder. This file has a script program that searches for files with HTM and HTML extensions on all removable and local hard drives, and overwrites them with a short text:

AmeRiCa …Few Days WiLL Show You What We Can Do !!! It’s Our Turn >>> ZaCkEr is So Sorry For You

The second VSB file the worm drops into the Windows system folder with the name, “ZaCker.vbs”, and registers it in the auto-run registry section. This means the file will be automatically executed upon the next Windows start-up. Upon being executed, it attempts to delete all files in the Windows directory, overwrites AUTOEXEC.BAT with a command destroying all data on drive C:, and then it displays the following message:

The worm finally reboots the computer. As a result, the system may be rendered unbootable or all data may be destroyed.