It uses the following
applications to spread itself as an attached file "666TEST.ZIP":
- E-mail client Microsoft Outlook
- Chat application mIRC
- Chat application Pirch
The archive contains one file, "666TEST.VBS". This is the worm itself.
When the script is executed, it first shows a message box:
After this, the virus starts a simple game:
The game asks for users name. When user enters anything to the dialog
and presses the "OK" button, it calculates the sum of ASCII
If the user does not enter anything or the game is cancelled then the
worm drops a file, called "WINTEMP.TXT". This file is used to create
another file, "WINTEMP.EXE", which is a PkZip executable. These files
are created to the Windows directory.
Worm then uses PkZip to create an archive called
"C:\Windows\666TEST.ZIP", which contains the worm. Then the archive is
copied to "C:\Windows\System\WINSWAP.SWP".
After creating the archive, VBS/Triplesix drops another script file
"C:\Windows\System\REGSVR.VBS" and modifies the registry in a such way
that this script will be executed when the system is restarted. When
executed, this script attempts to locate any mIRC, Pirch and Pirch98
installations. If one or more of these IRC clients are found, the worm
will overwrite their setup files ("script.ini" for mIRC, and
"events.ini" for Pirch and Pirch98) so the worm will send itself to other
chat users when they join to a IRC channel which has a user with an
Next, the worm attempts to send itself to everyone in the Outlook's
address book. The message it sends has the subject:
and the body of the message is:
> Does your name add up to 666 in ASCII characters?
Are you going to go to hell?
After mails has been sent, the worm will create the following registry
and set its value to "True", so the mass mailing will happen only
once per infected machine.
In 5th day of each month, the worm will drop another file to the
Windows directory, "VANHOUTEN.BMP", and set it to Windows wallpaper.
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]