Email-Worm.Win32.Xanax

Technical Details

This is an Internet worm that was found in the wild in the middle of March 2001. The worm spreads via e-mail by sending infected messages from affected computers through IRC channels by sending its copy there. The worm also infects EXE files in the Windows directory.

The worm itself is a Win32 application (PE EXE file) written in Microsoft Visual C++ language. The worm size is about 60K in length, but it was found in compressed form: the worm code was compressed by ASPack utility, possessing about 34K in length.

When the worm starts, it copies itself to the Windows system directory with two names: XANAX.EXE and XANSTART.EXE. The XANSTART.EXE file is then registered
in Registry auto-run key:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
Default = %winsystem%xanstart.exe

where %winsystem% is the name of the Windows system directory. As a result, the worm is run each time Windows starts up.

Infected E-mail

The worm then launches its e-mail spreading routine. To do this, the worm creates a temporary XANAX.VBS file (Visual Basic script), writes a VBS program there and starts it with the help of WSCRIPT.EXE. The VBS program gains access to the Outlook address book, and sends messages to the first 1,000 addresses from each of the address lists

Subject: Stressed? Try Xanax!
Body:

Hi there! Are you so stressed that it makes you ill? You’re not alone!
Many people suffer from stress, these days. Maybe you find Prozac too
strong? Then you NEED to try Xanax, it’s milder. Still not convinced?
Check out the medical details in the attached file. Xanax might change
your life!

Attachments: xanax.exe

Infecting EXE files

The worm then looks for EXE files in the Windows directory, and infects them. While infecting, the worm moves a victim file body down and writes itself to the file beginning. The worm does not infect files with names beginning with E, P, R, S, T, W.

IRC channels

Next, the worm infects the mIRC client if it is installed. The worm looks for the mIRC client in the following directories:

mirc
Program Filesmirc

on the C:, D:, E: and F: drives. If the mIRC client exists, the worm overwrites the SCRIPT.INI mIRC script file with a program that sends the worm’s copy to everybody who joining the infected channel.

Other Comments

When the worm is run from a file with name with the letter ‘R’ as the next to last one in a file name (xxxRx.EXE), it displays the following message:

The exact name as this contains the worm’s file XANSTART.EXE that is registered in the system Registry auto-run key. So, the worm displays this message upon each Windows start-up.

The worm also creates more files in the system:

Windows system directory: HOSTFILE.EXE

Windows directory: WINSTART.BAT, XANAX.SYS

The HOSTFILE.EXE remains after running an infected host file, and this file contains a pure (not infected) body of last infected file run.

The XANAX.SYS file contains the text:

Win32.HLLP.Xanax (c) 2001 Gigabyte

The WINSTART.BAT file contains commands that display the message:

Do not take this medication with ethanol, Buspar (buspirone), TCA
antidepressants, narcotics, or other CNS depressants.
This combination can increase CNS depression. Be sure not to take other
sedative, benzodiazepines, or sleeping pills with this drug. The combinations
could be fatal. Do not smoke or drink alcohol when taking Xanax. Alcohol can
lower blood pressure and decrease your breathing rate to the point of
unconsciousness. Tobacco and marijuana smoking can add to the sedative
effects of Xanax.