It then changes the name of the computer to Zacker by modifying the value of:
ComputerName to Zacker in the registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName

It also adds the value Zacker %SYSTEM%\Christmas.exe

to the registry key

HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run

so that the worm runs each time that you start Windows.

Next, the worm changes your Internet Explorer home page a malicious page that was created by the author of the worm. This page will be detected as JS.Exception.Exploit, even when using virus definitions dated prior to the December 18, 2001.

Next, the worm will display a windows with the text: "From the heart. Happy new year !"

Finally, the worm disables the keyboard. This means that the keyboard cannot be used until the computer is restarted without the worm being executed.

The Webpage
The webpage that this worm sets as the Internet Explorer start page is malicious. When visited, it contains code that will create the file %Windows%\Rol.vbs. This file will then be executed.

Rol.vbs
When this Visual Basic script is executed, it does the following:

1. Sets the Internet Explorer home page to a page that contains a shockwave flash video.
2. Copies itself to %SYSTEM%\Zacker.vbs.

NOTE: %System% is a variable. The worm locates the \Windows\System folder (by default this is C:\Windows\System or C:\Winnt\System32) and copies itself to that location.

3. Creates the file %SYSTEM%\Dalal.htm. This page contains a string that will be appended to .html. .htm, and .asp files.
4. Deletes several antivirus and security products. Norton Antivirus will be deleted if it is located in \Program Files\Norton Antivirus (on any drive).
5. Infects .html. .htm, and .asp files.
6. Overwrites files that have the following extensions:

.lnk, .zip, .jpg, .jpeg, .mpg, .mpeg, .doc, .xls, .mdb, .txt, .ppt, .pps, .ram, .rm, .mp3, .mdb, or .swf

with a copy of Zacker.vbs.

7. If Mirc.ini is found, all .ini files in that folder will be overwritten with a string that will cause an infected computer to send the URL to other users over the IRC network.

8. Finally, the worm will display a political message and attempt to exit Windows.

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. Delete all files that are detected as W32.Maldal.C@mm or JS.Exception.Exploit.
5. If any files are detected as infected by W32.Maldal.C@mm(html), click Repair.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:

HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run

4. In the right pane, delete the following value:

Zacker %SYSTEM%\Christmas.exe

5. Click Registry, and then click Exit

Top