I-Worm.Melting is an e-mail worm that appeared in March, 2000. The
worm itself is almost 18Kb long Win32 PE executable file and it is
written in VisualBasic. It spreads itself with e-mail messages by
attaching its body as 'MeltingScreen.exe' to them.
When an infected message is received and the attached worm executable
is run by a user, the worm gets control and starts its spreading
routine immediately. This routine connects to MS Outlook, opens
Address Book and gets e-mail addresses from there and then sends
messages with the attached worm body to these addresses. The infected
message subject is 'Fantastic Screensaver', and the message body
looks like this:
Hello my friend !
Attached is my newest and funniest Screensaver, I named it MeltingScreen.
Test it and tell me what you think.
Have a nice day my friend.
p.s.: Please install the Runtime Library for VB 5.0, before you run the ScreenSaver.
After spreading itself, the worm renames all EXE files in Windows
directory. The renamed files acquire BIN extension. Finally, the worm
shows a video effect that resembles 'melting' of the screen. Here is
a screenshot of the effect:
The worm has bugs and often freezes the computer when run. It doesn't
work if Visual Basic run-time libraries are not installed.
[Analysis: Eugene Kaspersky, AVP Team]