VIRUSES- DESTROYER OF COMPUTERS (CAI)

Virus Profile

==============================================

Bat/Firkin.Worm family (also known as 911) ==============================================

Bat/Firkin.Worm family The NIPC (U.S. National Infrastructure Protection Center - formed by the FBI) issued an advisory on the weekend concerning a family of batch worms that can propagate through Windows networks, erase hard drives and dial the 911 emergency line, possibly overloading the emergency response system. The advisory can be found at http://www.nipc.gov/nipc/advis00-038.htm The Firkin family consists of several batch files and there are three family members known right now. Variants of the worm contain code to wait for the 19th day of a month and then delete the following directories: "c:\windows\*.*" "c:\windows\system\*.*" "c:\windows\command\*.*" "c:\*.*" and afterwards displays the messages: "You Have Been Infected By Chode" "You may now turn this piece of s--t off!" The worm may change the Autoexec.bat file to call the emergency number 911 on each system start using an attached modem. Additionally it contains code to ping various servers on a random basis in a loop until an error occurs (.c variant). The spreading function first searches for a suitable target and tries to map the "c" drive of the attacked computer to the local drive name "j". In order to propagate, the worm has to find a writeable C share that is not protected by a password. Computer Associates recommends in general, not to share any drives or directories without assigning a password. During the complete spreading process, the worm prints information about the current attacked system etc., which are probably just debugging remnants. These messages are kept hidden from the user. If the attacked system does not have special files or directories (e.g. the .c version is looking for the file "c:\windows\win.com") the worm quits the replication process. The worm checks for signs of infections from other worms or family members and performs dependent operations. If all spreading conditions are fulfilled, then the virus copies itself using the ordinary copy operation. Additionally some variants overwrite with a random chance the "autoexec.bat" (e.g. 1/6 based on a random value for the .c version) file, and inserts code which formats, and performs other operations, on the following hard drives: C, D, E, F, G, H . Update all your virus signatures!!!!