|
|
||||||||||||||
|
|
VBS/Coolnot.A Worm Information Name: VBS/Coolnot.A
Description: A Visual Basic script worm, VBS/Coolnot.A uses the Outlook address book and mIRC to spread. The worm drops a copy of itself to C:\Windows\System\Cool_notepad_demo.txt.vbs and modifies the registry to run at startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Cool_notepad_demo.txt.vbs
VBS/Coolnot.A attempts to automatically connect to #virus during chat connects and sends a copy of itself to others on the channel. It also exploits the Outlook address book, sending itself to all recipients therein. The email message appears as follows:
Subject: "Cool Notepad Demo"
There is no malicious payload, though as with any email spamming worm, mail servers may suffer congestion-related problems if the worm should become widespread.
Detection: Command AntiVirus v4.58.3 and deffiles dated 05/30/00 provide detection and disinfection for this worm. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
|