Threat Description

IWorm_Melting

Details

Aliases:IWorm_Melting, I-Worm.Melting, Melting, MeltingScreen
Category: Malware
Type:
Platform: W32

Summary



I-Worm.Melting is an e-mail worm that appeared in March, 2000. The worm itself is almost 18Kb long Win32 PE executable file and it is written in VisualBasic. It spreads itself with e-mail messages by attaching its body as 'MeltingScreen.exe' to them.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



When an infected message is received and the attached worm executable is run by a user, the worm gets control and starts its spreading routine immediately. This routine connects to MS Outlook, opens Address Book and gets e-mail addresses from there and then sends messages with the attached worm body to these addresses. The infected message subject is 'Fantastic Screensaver', and the message body looks like this:

Hello my friend !
 Attached is my newest and funniest Screensaver, I named it MeltingScreen.
 Test it and tell me what you think.
 Have a nice day my friend.
 p.s.: Please install the Runtime Library for VB 5.0, before you run the ScreenSaver.
 
 

After spreading itself, the worm renames all EXE files in Windows directory. The renamed files acquire BIN extension. Finally, the worm shows a video effect that resembles 'melting' of the screen. Here is a screenshot of the effect:

The worm has bugs and often freezes the computer when run. It doesn't work if Visual Basic run-time libraries are not installed.





Technical Details: Eugene Kaspersky, AVP Team


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More