BAT/Firkin.A, B and C.Worm
| BAT/Firkin.A, B and C.Worm |
Destructivity:  Spreading:  Overall risk: 
|
| • Detected by virus detection files published: 4/2/2000 | • Type: Worm |
| • Virus characteristics first published: 4/2/2000 | • Spreading mechanism: Network |
| • Virus characteristics latest update: 12/17/2003 | • Overall risk: Low |
| Virus type |
Spreading mechanism |
Destructivity and payload |
Additional descriptions |
Detection and removal |
||||||||||
|
Firkin has a set of dangerous payloads. Most of these are added as batch commands to the AUTOEXEC.BAT file on the remote drive while Firkin is infecting. The payloads are not always added; this is controlled by a random function. They are somewhat different between the A, B and C variants: A variant:1/6 probability: dials 911 (tries COM1-COM4) 3/6 probability: does nothing 2/6 probability: formats drives H, G, F, E, D, C and prints: "You have been sLamMeD By fOREsKIN mOThERfUCKER" B variant:1/7 probability: dials 911 on COM1 1/7 probability: dials 911 on COM2 1/7 probability: dials 911 on COM3 1/7 probability: dials 911 on COM4 3/7 probability: formats drives H, G, F, E, D, C and prints: "You have been sLamMeD By fOREsKIN mOThERfUCKER" C variant:4/7 probability: dials 911 (tries COM1-COM4) 2/7 probability: does nothing 1/7 probability: formats drives H, G, F, E, D, C and prints: "tHE cHOdE gOTcHA yOu sTUpID mOThER fUCKeR!!!!!!!!!!!!!!" On startup this version will also run a VB Script file that checks whether the date is the 19th of any month. In that case it deletes files in the subdirectories c:\windows, c:\windows\system, c:\windows\command, and c:\, rendering the system unusable. |
||||||||||||||