Redesi Worm

A worm disguising itself as a security patch for Microsoft products will in fact reformat the victim's C: drive. The Redesi worm spreads by e-mail under a number of guises, and is set to trigger on November 11, 2001. Redesi has so far been seen in two variants; either as a Microsoft patch or as what will appear to most people more like junk e-mail. In the first case, the e-mail worm comes with a header randomly selected from a list that includes "FW: Microsoft security update," and "FW: Security Update by Microsoft."

The body of the e-mail purports to be sending on an e-mail from Microsoft's support desk, with the comment: "Just received this in my e-mail I have contacted Microsoft and they say it's real!" After a fake Microsoft header containing the subject "Security Update", is the following message:

<<...OLE_Obj...>>
"Due to the recent spate of e-mail spread computer viruses Microsoft Corp. has released a security patch. Please apply the attached file to your Windows computer to stop any further spread or these malicious programs.

The second variant arrives with headers such as: "Scientists have found traces of the HIV virus in cows milk...here is the proof -- Will", "Yay. I caught a fish -- Six", and "I want to live in a wooden house -- Arwel". This variant contains the text: "heh. I tell ya this is nuts ! You gotta check it out !", and names the offending attachment from the following list:

Both versions are equally dangerous, said Denis Zenkin of antivirus company Kaspersky Labs, but only PCs running older versions of Windows that use the autoexec.bat file are vulnerable to having their hard disks formatted on 11 November. Aside from sending e-mail copies of itself to every address in Outlook, Redesi writes a comment into the autoexec.bat file of PCs. This comment attempts to format the C: drive if the machine is booted up on 11 November. PCs that run Windows 2000 and Windows XP are immune from this formatting, since these versions of Microsoft's operating system do not use autoexec.bat. But any machine running Outlook will still be susceptible to the part of the virus that e-mails itself on to others in the contacts book.

Redesi.a selects an e-mail subject from the following list:
FW: Microsoft security update
FW: Security Update by Microsoft
FW: IT departments on state of HIGH ALERT
FW: Important news from Microsoft
FW: Stop terrorists computer viruses reign
FW: Terrorists release computer virus
FW: Emergency response from Microsoft Corp. FW: Terrorist Emergency.
Latest virus can wipe disk in minutes
FW: Microsoft Update. Final Release Candidate
FW: New computer virus

Redesi.b selects its email subject from this list:
hell is coming for u, u will be sucked into a bottomless pit!!! -- Gaz
Scientists have found traces of the HIV virus in cows milk...here is the proof -- Will
Yay. I caught a fish -- Six
I don't want to write anything but Si is bullying me. -- Jim
I want to live in a wooden house -- Arwel
Michelle still owes me ?10 ...-- Si
Why have I only got cheese and onion crisps? I hate them !! -- Si
A new type of Lager / Weed variant...... sorted !
My dad not caring about my exam results -- by Michelle