UNDERGROUND

replication technique causes the code to be modified slightly which indicates the source of the attack and learned information.

All analysis was done with more haste than I care for, but I believe I have all of the basic facts correct. First a description of the program:

1. The program assures that it is working in a directory to which

the owner (itself) has full access (Read, Write, Execute, and

Delete).

2. The program checks to see if another copy is still running.

It looks for a process with the first 5 characters of 'NETW_'. If

such is found, it deletes itself (the file) and stops its process.

NOTE A quick check for infection is to look for a process name starting with 'NETW_'. This may be done with a SHOW PROCESS command.

3. The program then changes the default DECNET account

password to a random string of at least 12 characters.

4. Information on the password used to access the system is

mailed to the user GEMTOP on SPAN node 6.59. Some ver-

sions may have a different address.11

5. The process changes its name to 'NETW_' followed by a

random number.

6. It then checks to see if it has SYSNAM priv. If so, it defines

the system announcement message to be the banner in the

program:

WORMS AGAINST NUCLEAR KILLERS _____________________________________________________________________\

\ /\ / / / \ / \ | | | | / / /

\ \ / \ / / / \_/ \ \ | | | |/ / /

\ \ / /\ \ / / / / \ | | | / / /

\ \_/ / \ \_/___/___/___________/_______ \|___|___|__/_ /_ /

\ /

\ /

\ Your System Has Been Officically WANKed /

\_______________________________________________________/

You talk of times of peace for all, and then prepare for war.