FANDOM


Alcaul is a worm on Microsoft Windows. It is written in Visual Basic Script.

Payload

Once executed by the user, the worm opens up a Flash Player window named Boozer's Delight, which has a picture of a drunk man with the words "I'm in your computer" written on the bottom. While the user figures out what has happened, the worm already mass mails itself to all of the users contacts (using Outlook).

Variants

Alcaul.B

Alcaul.B@mm is a worm that sends itself to all the contacts in the Microsoft Outlook Address Book. The email that the worm sends has the following characteristics:

Subject: ***Wow Found Binladen**** Attachment: Random name with .vbs file extension

Alcaul.C

Alcaul.C would send a copy of itself as an email attachment to all entries in the user's Outlook address book. The email will have the  subject "Happy New Year! You've Got Yourself A Gift!" and a message body that attempts to persude the user that by running the attachment they will receive some free marijuana. The attached worm will have the name freeHashish.exe.

The worm will be copied to the file C:\Windows\freeHashish.exe, and a  registry value "Freebies and Goodies" will be added to the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The new value willpoint to the copy of the worm and will result in the worm being executed on Windows startup.

A batch file is created in the Windows startup directory that attempts to execute a copy of the worm that may be dropped to C:\Recycled\Alco.exe. The worm will also display a message box that prompts the user to enter their email address. If the user carries out the request then Internet Explorer will open up the web page http:\\www.yahooka.com, and an email will be sent from the user to the account curlytop@blackcodemail.com.

Media

Alcaul

Alcaul.exe Windows Worm

Community content is available under CC-BY-SA unless otherwise noted.