Redesi worm reformats C: drives
A worm disguising itself as a security patch for Microsoft products will in fact reformat the victim's C: drive. The Redesi worm spreads by email under a number of guises, and is set to trigger on 11 November 2001. But not all PCs are vulnerable to the worst of its effects, and there is an easy way to stop the damage.
Redesi has so far been seen in two variants; either as a Microsoft patch or as what will appear to most people more like junk email. In the first case, the email worm comes with a header randomly selected from a list that includes "FW: Microsoft security update," and "FW: Security Update by Microsoft."
The body of the email purports to be sending on an email from Microsoft's support desk, with the comment: "Just recieved this in my email I have contacted Microsoft and they say it's real !" After a fake Microsoft header containing the subject "Security Update", is the following message:
"Due to the recent spate of email spread computer viruses Microsoft Corp has released a security patch. Please apply the attached file to your Windows computer to stop any further spread or these malicious programs. Regards Microsoft Support"
The second variant arrives with headers such as: "Scientists have found traces of the HIV virus in cows milk...here is the proof -- Will", "Yay. I caught a fish -- Six", and "I want to live in a wooden house -- Arwel".
This variant contains the text: "heh. I tell ya this is nuts ! You gotta check it out !", and names the offending attachment from the following list:
Both versions are equally dangerous, said Denis Zenkin of antivirus company Kaspersky Labs, but only PCs running older versions of Windows that use the autoexec.bat file are vulnerable to having their hard disks formatted on 11 November.
Aside from sending email copies of itself to every address in Outlook, Redesi writes a comment into the autoexec.bat file of PCs. This comment attempts to format the C: drive if the machine is booted up on 11 November. PCs that run Windows 2000 and Windows XP are immune from this formatting, since these versions of Microsoft's operating system do not use autoexec.bat. But any machine running Outlook will still be susceptible to the part of the virus that emails itself on to others in the contacts book.
Protecting a PC from the formatting effects of the virus is relatively simple, said Zenkin. The Redesi virus checks the system date and if it is 11/11/01, attempts the format. This means that PCs using both the European and US shortform dates are vulnerable. The solution, according to Zenkin, is to set the date to the long format, using four digits for the year. "If they don't match then the payload will never be activated," said Zenkin. Many older PCs will have their date set to the long format already to make them immune from the Y2K bug, which results from confusion over which century a date falls in when the short date format is used.
Zenkin said Kaspersky Labs had received no reports of the worm in the wild yet. Microsoft did not respond to requests for comment at the time of posting.
Redesi.a selects an email subject from the following list:
Redesi.b selects its email subject from this list:
See the Viruses and Hacking News Section for the latest headlines.
Have your say instantly, and see what others have said. Click on the TalkBack button and go to the Security forum.
Let the editors know what you think in the Mailroom. And read other letters.