Selected viruses, spyware, and other threats: sorted alphabetically

W32/Zoek.worm

Win32/Zoek.D is a worm spreading as an email file attachment.  It requires the operation system Windows 95 or higher.  The worm has a size of 217600 bytes, and it is compressed by UPX.  After unpacking its size is almost 500 KB.

Win32/Zoek.D arrives as an email message with the subject "Maxima Screensaver!".  In the attachment of this message there is a file named screenmaxima.scr containing the worm.  It has a size of 217600 bytes.

Note: In following text a symbolic inscription %windir% is used instead of the name of directory in which Windows operating system is installed. Of course, this may differ from installation to installation.

After the file screenmaxima.scr in the directory %WinDir% is run it creates files accountboy.ini, attachready.ini, hoen.txt, mailboy.ini, mailboy2.ini, passboy.ini, tcasuta.exe and tcasuta.txt.  The copy of the worm is located in the file tcasuta.exe.

The worm sends its copies to all addresses found in the Outlook Express Contacts.  Sometimes it installs into the system a Trojan horse enabling the remote access to the infected computer.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.