Method of Infection

This is a combination of a files infector virus and an email worm.

The virus arrives as an.EXE file with varying filenames. When you execute the attachment, your machine is infected and in turn is used to spread the virus.

When first run, the virus may copy one.EXE file in the Windows or Windows System directory using the same name but with the final character of the filename decreased by a factor of 1. For example, EHGEDI57.EXE will become EHGEDI56.EXE, TCONTRACT.EXE will become TCONTRACS.EXE.

This copy is then infected and a WIN.INI entry, or registry run key value may be created, to execute the infected file when the system starts up.

This copied executable infects other 32 bit.EXE files in the Windows directory and subdirectories, when run.

Five minutes after the file is opened, the email worm attempts a mailing routine. It creates a.DAT file hidden somewhere on the hard - disk. This contains strings of the files used to grab email addresses from address books and mailboxes. The.DAT file name will be named after the machine name in a coded fashion. For example, у becomes a, x becomes b. Numbers are not changed. The worm uses mass mailing techniques to send itself to these addresses. The subject headings, text and attachments will vary. The text is taken from other files on the victim's computer.

This worm may also alter the REPLY-TO email address when mailing itself to others. One letter of the address will be changed. This makes it difficult to warn the victim that their machine is infecting others as the message will be returned to sender.

18. Read the text again and answer the questions:

1. What is this method of infection combined of?

2. When is the computer infected?

3. Which way does the virus change file names?

4. What does the copied.EXE file do?

5. What does the email worm do?

6. How does the worm infect other computers?

7. What makes it difficult to know that the victim’s machine is infecting others?

19. Give Russian equivalents to the following words and phrases:

Files infector virus, an email worm, execute the attachment, machine is infected, to spread the virus, system directory, final character, registry run key value, entry, copied executable, worm attempts a mailing routine, hard-disk, strings to grab email addresses, in a coded fashion, mass mailing techniques, subject headings, victim's computer, alter email address, to warn the victim, message returned to sender.

20. Give English equivalents to the following words and phrases:

Заражающий файлы вирус, почтовый вирус-червь, запустить приложение, распространить вирус, компьютер заражен, при первом записке, последний символ имени файла, регистрационный ключ запуска программы, значение, зараженный файл, когда запускается система, скопированная рабочая программа (исполнимый код), почтовая программа (операция), захватить электронные адреса, адресная книга, закодировано, заголовок темы письма, компьютер жертвы, изменить электронный адрес отправителя, предупредить жертву, сообщение вернется отправителю.