Threat description



The Fix2001 is an Internet worm discovered in September 1999. The worm arrives as a 12kb "Fix20001.Exe" file attached to an e-mail message. The message's subject is "Internet problem year 2000." and the body text is in both English and Spanish:

Estimado Cliente:  Rogamos actualizar y/o verificar su Sistema Operativo para el  correcto funcionamiento de Internet a partir del Ato 2000. Si  Ud. es usuario de  Windows 95 / 98  puede hacerlo mediante el  Software provisto por  Microsoft (C) llamado -Fix2001- que se  encuentra adjunto en este E-Mail o bien  puede ser descargado  del sitio WEB de Microsoft (C)  HTTP://WWW.MICROSOFT.COM  Si Ud. es usuario de otros Sistemas Operativos, por favor, no  deje de consultar con sus respectivos soportes tecnicos.         Muchas Gracias. Administrador.  Internet Customer:  We will be glad if you verify your Operative System(s) before  Year 2000 to avoid problems with your Internet Connections.  If you are a  Windows 95 / 98 user, you can check your system  using the Fix2001 application that is attached to this E-Mail  or downloading it from Microsoft (C) WEB Site:  HTTP://WWW.MICROSOFT.COM  If you are using  another Operative System, please don't wait  until Year 2000, ask your OS Technical Support.    Thanks. Administrator.  

Being run the worm installs itself to system and modifies Registry to be run during all further Windows sessions. The worm copies itself to \Windows\System directory and shows a messagebox:

This is a disguise only. After that the worm terminates until the next reboot. Being from the installed FIX2001.EXE copy after reboot the worm registers itself as a system service process (to hide its window and stay active on user logoff) with the "AMORE_TE_AMO" process ID and traps Connect and Send functions of WSOCK32.DLL (Windows Sockets Library used to connect to Internet). The trapped functions' addresses are patched so that they point to worm code and the worm could monitor certain activities. The Happy99/Ska worm uses the same technique.

When a valid Internet connection is detected, the worm scans sent and received messages, gets e-mail addresses from there, and sends its copy with the above mentioned message to these addresses.

The worm has a dangerous payload that is activated in case the text strings in the worm's body are patched or corrupted. In this case the worm overwrites the C:\COMMAND.COM file with a DOS trojan that will erase all data on hard drive after the system is rebooted. This may also happen if worm is corrupted during transfer.

The worm has several internal text strings including e-mail templates and a message:



Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.


F-Secure provides detection and disinfection for this worm with the latest AVP and F-Prot updates that can be downloaded from our ftp site.

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info