Summary
Summary
Action- More Information
| Included in our products from | August 2000 (3.36) |
|---|---|
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Search for recycled.vxd and move it back to your Windows folder (usually WINNT in Windows NT/2000 and Windows in Windows 95/98/Me). Rename recycled.vxd to regedit.exe.
You should also check any other computers on your network for infection.
More Information
This worm spreads via Microsoft Outlook email and over IRC using mIRC or Pirch.
The mIRC element of this worm is detected by Sophos Anti-Virus as mIRC/Stages-A and the Pirch element is detected as pIRC/Stages-A.
Via email, the worm sends a message whose subject is constructed from the following terms: "Fw:", "Life Stages", "Funny", "Jokes" and " text".
The body of the message may contain the text "The male and female stages of life."
The worm itself is attached as a file called LIFE_STAGES.TXT.SHS. When it runs, the worm displays the following text:
- The male stages of life:
Age. Seduction lines.
17 My parents are away for the weekend.
25 My girlfriend is away for the weekend.
35 My fiancee is away for the weekend.
48 My wife is away for the weekend.
66 My second wife is dead.
Age. Favorite sport.
17 Sex.
25 Sex.
35 Sex.
48 Sex.
66 Napping.
Age. Definiton of a successful date.
17 Tongue.
25 Breakfast.
35 She didn't set back my therapy.
48 I didn't have to meet her kids.
66 Got home alive.
- The female stages of life:
Age. Favourite fantasy.
17 Tall, dark and hansome.
25 Tall, dark and hansome with money.
35 Tall, dark and hansome with money and a brain.
48 A man with hair.
66 A man.
Age. Ideal date.
17 He offers to pay.
25 He pays.
35 He cooks breakfast next morning.
48 He cooks breakfast next morning for the kids.
66 He can chew his breakfast.
It then attempts to create copies of itself on all available network drives. It also moves the regedit.exe to the recycled folder and changes its name to recycled.vxd.
|
