Threat Descriptions

IWorm_Melting

Classification

Category :

Malware

Type :

-

Platform :

-

Aliases :

IWorm_Melting, I-Worm.Melting, Melting, MeltingScreen

Summary

I-Worm.Melting is an email worm that appeared in March, 2000. The worm itself is almost 18Kb long Win32 PE executable file and it is written in VisualBasic. It spreads itself with email messages by attaching its body as 'MeltingScreen.exe' to them.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

When an infected message is received and the attached worm executable is run by a user, the worm gets control and starts its spreading routine immediately. This routine connects to MS Outlook, opens Address Book and gets email addresses from there and then sends messages with the attached worm body to these addresses. The infected message subject is 'Fantastic Screensaver', and the message body looks like this: 

Hello my friend !
Attached is my newest and funniest Screensaver, I named it MeltingScreen.
Test it and tell me what you think.
Have a nice day my friend.
p.s.: Please install the Runtime Library for VB 5.0, before you run the ScreenSaver.

After spreading itself, the worm renames all EXE files in Windows directory. The renamed files acquire BIN extension. Finally, the worm shows a video effect that resembles 'melting' of the screen. Here is a screenshot of the effect:

The worm has bugs and often freezes the computer when run. It doesn't work if Visual Basic run-time libraries are not installed.