The worm is written in Visual Basic. Its file is a UPX-packed PE
executable 13824 bytes long. The unpacked worm's file size is
over 61 kilobytes.
Installation to system
When the worm's file is run, it copies itself to Windows
directory as SERVICES.EXE file and creates startup keys for this
file in System Registry:
"Norton Auto-Protect" = "SERVICES.EXE"
"Windows Service" = "SERVICES.EXE"
"auto update" = "SERVICES.EXE"
"LUALL.exe" = "SERVICES.EXE"
@ = "SERVICES.exe %1"
The worm also creates keys in the Registry that contain its name,
version, source language, virus writer hadle and features list.
Additionally the worm copies itself to startup folders of all
The worm creates a text file named 'Norton AntiVirus.txt' in the
root folder of C: drive and writes the following text there:
Script Blocking: Disabled
Spreading in E-mails
The worm spreads itself in e-mail messages. It reads Outlook
Address Book and sends an e-mail with its attached file to all
found e-mail addresses. The worm sends the following message:
Service Pack 2 BUG!!
Dear user I have been informed that there was a BUG in Windows
Service Pack 2 which was fixed I recommend you to download this
Patch version which will fix the bug and keep your system safe.
You will find the Patch file in the attachment, feal free to
send it to anyone.
I'll be in touch with you as soon as another bug is found.
The attachment is a ZIP archive with the worm's file named
'Fix_SP2.exe'. This ZIP archive is downloaded by the worm from an
account on Geocities webserver before spreading. To get infected,
a user has to extract and run the worm's file.
The worm modifies HOSTS file to block access to certain websites.
The addresses of these websites are changed to localhost
(127.0.0.1). Here's the list of the websites that the worm blocks
Additionally the worm modifies the Registry affecting security
settings (firewall, autoupdate, anti-virus disable notifications,
etc.). Also System Restore, 'Run' option in the Start Menu,
Registry Tools and Task Manager get disabled. Certain
applications are not allowed to run any more:
The worm tries to change computer name, ProdictID of Windows and
Internet Explorer to "Agent Hacker".
The worm also runs TASKKILL application to kill certain
Detection for this malware was published in the following F-Secure Anti-Virus updates:
Alexey Podrezov, February 2nd, 2005;