Posted by Paco (204.111.30.154) on February 10, 2002 at 09:19:39:
A Comical Story -- WORM_COMICAL.A (Low Risk)
------------------------------------------------------------------------
WORM_COMICAL.A arrives as an email attachment COMICAL_STORY.DOC, which contains
the worm and a Visual Basic Script file, that obtains email addresses from an
infected user's address book and sends itself as an attachment.
When the .DOC attachment is opened, it displays a fake message box and creates
a VB Script file, which Trend Micro antivirus detects as VBS_COMICAL.A.
Upon execution, the worm creates a BACKUP.WIN file in the root directory.
This file contains the email addresses found in an infected user's Microsoft
Outlook application. The worm then drops an .EXE file that Trend Micro antivirus
detects as WORM_COMICAL.A.
VBS_COMICAL.A drops and then executes WORM_COMICAL.A. Upon execution WORM_COMICAL.A
sends an email to all addresses listed in the infected user's address book. The details
of the email it sends are as follows:
SUBJECT: A comical story for you.
MESSAGE BODY: I send you a comical story found on the Net.Best Regards.
Your friend.
ATTACHMENT: comical_story.doc