Threat Descriptions

Triplesix

Classification

Category :

Malware

Type :

Worm

Platform :

VBS

Aliases :

Triplesix, VanHouten, 666test

Summary

VBS/Triplesix is a Visual Basic Script worm.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

It uses the following applications to spread itself as an attached file "666TEST.ZIP": 

- email client Microsoft Outlook
- Chat application mIRC
- Chat application Pirch

The archive contains one file, "666TEST.VBS". This is the worm itself. When the script is executed, it first shows a message box:

After this, the virus starts a simple game:

The game asks for users name. When user enters anything to the dialog and presses the "OK" button, it calculates the sum of ASCII characters.

If the user does not enter anything or the game is cancelled then the worm drops a file, called "WINTEMP.TXT". This file is used to create another file, "WINTEMP.EXE", which is a PkZip executable. These files are created to the Windows directory.

Worm then uses PkZip to create an archive called "C:\Windows\666TEST.ZIP", which contains the worm. Then the archive is copied to "C:\Windows\System\WINSWAP.SWP".

After creating the archive, VBS/Triplesix drops another script file "C:\Windows\System\REGSVR.VBS" and modifies the registry in a such way that this script will be executed when the system is restarted. When executed, this script attempts to locate any mIRC, Pirch and Pirch98 installations. If one or more of these IRC clients are found, the worm will overwrite their setup files ("script.ini" for mIRC, and "events.ini" for Pirch and Pirch98) so the worm will send itself to other chat users when they join to a IRC channel which has a user with an infected client.

Next, the worm attempts to send itself to everyone in the Outlook's address book. The message it sends has the subject: 

666 test

and the body of the message is:

> Does your name add up to 666 in ASCII characters?

 Are you going to go to hell?

After mails has been sent, the worm will create the following registry key: 

HKEY_LOCAL_MACHINE\Software\MIRC/OUTLOOK/PIRCH.VanHouten

and set its value to "True", so the mass mailing will happen only once per infected machine.

In 5th day of each month, the worm will drop another file to the Windows directory, "VANHOUTEN.BMP", and set it to Windows wallpaper.