This is an Internet worm that was found in the wild in the middle of March 2001. The worm spreads via e-mail by sending infected messages from affected computers through IRC channels by sending its copy there. The worm also infects EXE files in the Windows directory.
The worm itself is a Win32 application (PE EXE file) written in Microsoft Visual C++ language. The worm size is about 60K in length, but it was found in compressed form: the worm code was compressed by ASPack utility, possessing about 34K in length.
When the worm starts, it copies itself to the Windows system directory with two names: XANAX.EXE and XANSTART.EXE. The XANSTART.EXE file is then registered
where %winsystem% is the name of the Windows system directory. As a result, the worm is run each time Windows starts up.
The worm then launches its e-mail spreading routine. To do this, the worm creates a temporary XANAX.VBS file (Visual Basic script), writes a VBS program there and starts it with the help of WSCRIPT.EXE. The VBS program gains access to the Outlook address book, and sends messages to the first 1,000 addresses from each of the address lists
Infecting EXE files
The worm then looks for EXE files in the Windows directory, and infects them. While infecting, the worm moves a victim file body down and writes itself to the file beginning. The worm does not infect files with names beginning with E, P, R, S, T, W.
Next, the worm infects the mIRC client if it is installed. The worm looks for the mIRC client in the following directories:
on the C:, D:, E: and F: drives. If the mIRC client exists, the worm overwrites the SCRIPT.INI mIRC script file with a program that sends the worm’s copy to everybody who joining the infected channel.
When the worm is run from a file with name with the letter ‘R’ as the next to last one in a file name (xxxRx.EXE), it displays the following message:
The exact name as this contains the worm’s file XANSTART.EXE that is registered in the system Registry auto-run key. So, the worm displays this message upon each Windows start-up.
The worm also creates more files in the system:
The HOSTFILE.EXE remains after running an infected host file, and this file contains a pure (not infected) body of last infected file run.
The XANAX.SYS file contains the text:
The WINSTART.BAT file contains commands that display the message: