W32.Melting.Worm


Aliases: W95/Melting.worm, Win32/Melting@mm, Troj_Melting.A, Melting.A, PE_Melting.A
Variants: Email-Worm.Win32.Melting, I-Worm.Melting, W32/Melting@M, Win32.HLLW.Melting, W32/Melting

Classification: Malware
Category: Computer Worm

Status: Dormant
Spreading: Slow
Geographical info: Asia, Europe, North and South America
Removal: Easy
Platform: W32
Discovered: 13 Mar 2000
Damage: Low

Characteristics: Programmed as a 32-bit executable it requires the presence of the runtime libraries of the Visual Basic programming language to correctly execute in a host machine. According to some antivirus vendors the requisite of program dependencies is the reason why the W32.Melting.Worm is now considered as dormant. The inherent defects in its source code leads to the crashing of the computer system when it is executed. It is sent as an email file attachment.

More details about W32.Melting.Worm

Part of the dependency of this threat is that all the Dynamic Link Library files of the Visual Basic runtime libraries must be present in the compromised computer system. This is the reason why the email message that accompanies its trigger file instructs the recipient to install these necessary file components before running the attachment. The W32.Melting.Worm is normally sent as a screensaver file with the message body informing the recipient that the file is a funny screensaver that must be seen. The sender of the email supposedly is the programmer of the screensaver which is named MeltingScreen which actually is in reference to the W32.Melting.Worm malware. The W32.Melting.Worm can use blind links in malicious websites to cause unwary users to download its trigger file.

Computer security experts consider the W32.Melting.Worm as one of the more dangerous malware in the industry because of its design of renaming executable files into BIN format making them virtually unusable. The low damage level rating however stems from the fact that any payload built into this threat depends on a number of file dependencies. This means that the absence of any of the files will cause the W32.Melting.Worm to terminate and fail in the delivery of its payload. When successful the W32.Melting.Worm will launch a graphic routine that gives the illusion that the screen is melting.