Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Funny


Aliases:


Funny
I-WORM.Funny, VBS/Funny

Malware
Worm
VBS

Summary

Funny worm spreads in a similar way as LoveLetter. All three known variants of this worm drop, run and delete a binary file Startx.exe that is a password stealing trojan detected by F-Secure Anti-Virus as 'Trojan.PSW.Hooker.24.e'. This trojan is run if the virus found a UBS banking software installed on the victim's machine. Otherwise it replicates as a worm.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


Variant:Funny.A

This variant sends e-mail to all recipients in Outlook address book with:

Subject: Funny story
        Attachment: FUNNY_STORY.HTM.vbs

In addition, it tries to connect to a web location.


Variant:Funny.B

This variant is similar with Funny.A, but it sends messages with the following:

Subject: When did you die?
        Attachment: LIFE_ASSURANCE.HTM.vbs


Variant:Funny.C

Funny.C spreads in messages with:

Subject: Rechnungsabschrift
        Attachment: RECHNUNGSABSCHRIFT.DOC.vbs

This variant does not try to connect to the web. It creates a text file RECHNUNGSABSCHRIFT.DOC and open it with Write.exe. The text file contains the following information:

  INVOICE
    Date:  September 18, 2000
    From:  Katrin Heinze
       19, chemin des Aulx
       CH-1228
       Plan-les-Ouates,
       Geneva
       Switzerland
    To:   Myron Schmidt"
       Ch. des Boveresses 151
       CH-1066 Epalingess/Lausanne
       Switzerland
    Item    Description
    Item    Description       Cost

  1      August Voice Mail Charges      CHF  35.00
    1      Internet - Reserve Domain Name (2 years)   CHF  250.00
    1      Internet - Set Up Fee          CHF  110.00
    1      Internet - Creation Fee        CHF  250.00
    1      Internet - Submit to 540 Search Engines    CHF  50.00
    1      Internet 6 Months of Hosting   CHF  200.00
    Total         CHF 895.00





Technical Details: Katrin Tocheva, F-Secure, September 2000



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.