W32.Music.A.Worm


Aliases: W32/Music.A.Worm
Variants: IWorm_Music, I-Worm.Music, W32/Music@m, W32/Music

Classification: Malware
Category: Computer Worm

Status: Inactive
Spreading: Moderate
Geographical info: N/A
Removal: Hard
Platform: W32
Discovered: 30 Nov 2000
Damage: Low

Characteristics: This malware is a worm that is only capable of running on computer systems under Windows 98 and Windows 95. The W32.Music.A.Worm needs a particular Win32 API (application programming interface) that is only found in Windows 98 and Windows 95 versions of the file Kernel32.dll. This worm employs three components for its malicious tasks. These components are the WinSock library, the dropper and the sender or mailing component.

More details about W32.Music.A.Worm

The W32.Music.A.Worm will automatically use it sender or mailing component for sending an infected email message once it is executed. This email message has an attachment under the name Music.com that contains its dropper component copy. The worm will also modify the registry by registering its dropper component and create a duplicate of its dropper component. It will then go on to display a cartoon photo of Santa Claus with an accompanying Merry Christmas message and music so that it can mask itself. The security risk will also try to retrieve its updated components from predetermined Internet websites. In the event that updated components are available, the worm will download and then install them to the victim machine. The worm’s dropper component does not send messages.

The worm’s sender component is retrieved from a predefined website and then copied to the compromised machine. It is tasked with acquiring email addresses from the address book of Windows and sending infected email messages containing the dropper the obtained addresses. The W32.Music.A.Worm’s third component is the WinSock library which is a typical DLL library of the Microsoft Visual Studio that is utilized for accessing Windows sockets. To remove the worm’s infection, Click Start and the Run. Type in regedit in the Run dialog box and then click OK. When the registry Editor opens, go to the registry entries added by the worm and the delete them. Close the Registry Editor and then restart the system in Safe mode. Delete all the worm’s dropped files.