FANDOM


Email-Worm.Win32.White (shortened as just White) is a worm that runs on Win32.

Payload

The worm spreads via email, and is attached to the email. When the worm is executed, it will display a message intended to trick the user into thinking that a file is unpacking, after a couple of seconds, it will display this message:

Error: UnPACK
unPack Error: I can't fix the error. Please reDownload.

This message's purpose is to trick the user into thinking that the download failed and the program crashed. However, the worm will then drop it's files into the Windows directory, and will run on every restart. It will spread by making the user's replies to emails repeat the email. On the 31st of the month, it will then have a different outcome.

Running the file on the 31st will cause it to display the following message:

I-WORM/WHITE???
It's happy to^day (31)

It will then edit the user's autoexec.bat, so when the user restarts, the user's hard drive will be formatted, however, the format may fail and cause the system disk to be invalid.

Media

Community content is available under CC-BY-SA unless otherwise noted.