Name: I-Worm.Thonic. Category: Viruses Description: Details I-Worm.Thonic.a This worm spreads via the Internet as an attachment to infected messages. The worm itself is a Windows PE EXE file, and it is 5482 bytes in size. It searches for and infects PE files with the extensions .exe, .cpl, scr. The worm intercepts calls to the following Windows API functions: WinExec, MoveFile and SetCurrentDir calls. When they are called, the worm searches for files and infects them. When infecting files, the worm writes itself to the end of the files under the name .Nameles. It cannot spread independently by email. Propagation via email is carried out by a VBS script. The script in 875 bytes in size, and saved as C:\VQmSXjvyc.vbs. The executable file infects notepad.exe and copies it to the C: root directory as funnystuff.avi.exe The script then executes, sending the file funnystuff.avi.exe by mail. It contains the text: Win32.Nameless Mist - AzagTH0TH Infected messages: Infected messages have the following attributes: Message header: Free MyDoom.B Patch ! Message body: Very urgent ! You should run this patch to protect your Windows OS immediately to avoid this danger virus variant. Thank You, Microsoft Technical Support Staff Any rights not expressly granted herein are reserved. Contact Microsoft with questions or problems. (c) 2004 Microsoft Corporation. All rights reserved Attachment name: C:funnystuff.avi.exe The worm will be activated only if the user launches the infected file by clicking twice on the attachment. It then infects executable system files. It uses Windows MAPI to send messages. Message mailing When sending infected messages, the worm accesses MS Outlook and sends itself to all addresses harvested from the address book.