W32.Spester@mm


Aliases: I-Worm.Spdtest, VBS/Generic@MM, VBS/SpeedTest-A, VBS/Spdtest*, VBS_SPESTER.A,
Variants: Worm/SpdText, VBS/Spester.A@mm, VBS:Generic-Mail, I-Worm/Spdtest, VBS.Spdtest.A@mm,

Classification: Malware
Category: Computer Worm

Status: Active & Spreading
Spreading: Fast
Geographical info: Asia, North and South America, and some parts of Europe and Australia
Removal: Easy
Platform: W32
Discovered: 11 Jan 2002
Damage: Low

Characteristics: The W32.Spester@mm application is a worm that multiplies as a .zip file. Within the .zip file is the worm executable file. When opened, the executable makes a (.vbs) or Visual Basic Script files that try to send the compressed file to all contacts in the address book.

More details about W32.Spester@mm

The W32.Spester@mm application is a worm that multiplies as a “.zip” file. W/in the “.zip” file is the worm “.exe” file. When the worm is opened, the executable or .exe files makes a “.vbs” or Visual Basic Script file that tries to send the compressed “.zip” file to all contacts in the address book. If the W32.Spester@mm worm is extracted from the “.zip” file and opened, it makes the Visual Basic Script or .vbs file “C:\Program Files\Internet Explorer\OneClock.vbs”, which the attempts to email messages to all contacts in the address book. The email message has the following characteristics: “Subject: game: Speed tester v. 1.0 - check your mouse skills”, “Message: Hello, How good are your mouse movement skills? Wanna test it? If yes try game Speed tester v.1.0. (you have it in attachment)”, and “Attachment: Spdtest.zip and Oneclock.vbs.

The W32.Spester@mm worm also adds the value “OneClock wscript C:\Program Files\Internet Explorer\oneclock.vbs” to the registry key, so that it opens every time you open the Windows. The W32.Spester@mm also tries to multiply making use of the mIRC by making the file “Script,ini” in the “\Mirc” folder (if you have mIRC folder). The W32.Spester@mm tries to cover itself as a joke software by asking you to push a button. When you do, it shows a message that you are very slow. After showing this message, the software pretends to configure drive C.