SOHO Technology -- Panda Informs of the Emergence of I-Worm/SouthPark

Panda Informs of the Emergence of I-Worm/SouthPark

LOS ANGELES--(BUSINESS WIRE)-- I-Worm/SouthPark is a worm infector created in Visual Basic 5.0. This implies that infected machines need to have the MSVBVM50.DLL file installed in order for the virus to work, thereby limiting its scope. However, it constitutes a high-risk infection due to its spreading power, as this worm is capable of spreading in three different ways.

The virus spreads through the Microsoft Outlook e-mail program in the form of an attachment included in a message sent to all the addresses listed in infected users' address books. The mail message features the following characteristics:

Subject: "Servus Alter"

Body: "Hier ist das Spiel, das du unbedingt wolltest! ;-)"

It includes an attachment called "South Park.exe"

It copies itself to all mapped drives.

It is capable of spreading on floppy disks.

I-Worm/SouthPark creates a file called V.REG in drive C:\, which is responsible for placing an entry in the Windows registry that ensures that the worm is run every time the computer is booted. It then creates a file called "South Park.Exe" in each mapped drive, including drive A, in which case it carries out another somewhat more complex process. The reason behind copying to a floppy disk is to ensure that the worm is copied to the startup folder if the user accidentally boots the computer from an infected floppy. This ensures that the worm will be executed the next time the system is started up.

The destructive effect produced by I-Worm/SouthPark consists of the creation of a file in the C:\Windows folder called Swapfile.VXD, which grows continuously until it takes up all available free space in drive C.

Return To The Top