A worm disguising itself as a security patch for Microsoft products will in fact reformat the victim's C: drive. The Redesi worm spreads by e-mail under a number of guises, and is set to trigger on November 11, 2001. But not all PCs are vulnerable to the worst of its effects, and there is an easy way to stop the damage.

Redesi has so far been seen in two variants; either as a Microsoft patch or as what will appear to most people more like junk e-mail. In the first case, the e-mail worm comes with a header randomly selected from a list that includes "FW: Microsoft security update," and "FW: Security Update by Microsoft."

The body of the e-mail purports to be sending on an e-mail from Microsoft's support desk, with the comment: "Just recieved this in my e-mail I have contacted Microsoft and they say it's real!" After a fake Microsoft header containing the subject "Security Update", is the following message:

"Due to the recent spate of e-mail spread computer viruses Microsoft Corp. has released a security patch. Please apply the attached file to your Windows computer to stop any further spread or these malicious programs. Regards Microsoft Support"

The second variant arrives with headers such as: "Scientists have found traces of the HIV virus in cows milk...here is the proof -- Will", "Yay. I caught a fish -- Six", and "I want to live in a wooden house -- Arwel".

This variant contains the text: "heh. I tell ya this is nuts ! You gotta check it out !", and names the offending attachment from the following list:

Si.exe
ReDe.exe
Disk.exe
Common.exe
UserConf.exe

Both versions are equally dangerous, said Denis Zenkin of antivirus company Kaspersky Labs, but only PCs running older versions of Windows that use the autoexec.bat file are vulnerable to having their hard disks formatted on 11 November.

Aside from sending e-mail copies of itself to every address in Outlook, Redesi writes a comment into the autoexec.bat file of PCs. This comment attempts to format the C: drive if the machine is booted up on 11 November. PCs that run Windows 2000 and Windows XP are immune from this formatting, since these versions of Microsoft's operating system do not use autoexec.bat. But any machine running Outlook will still be susceptible to the part of the virus that e-mails itself on to others in the contacts book.

Protecting a PC from the formatting effects of the virus is relatively simple, said Zenkin. The Redesi virus checks the system date and if it is 11/11/01, attempts the format. This means that PCs using both the European and US shortform dates are vulnerable. The solution, according to Zenkin, is to set the date to the long format, using four digits for the year. "If they don't match then the payload will never be activated," said Zenkin. Many older PCs will have their date set to the long format already to make them immune from the Y2K bug, which results from confusion over which century a date falls in when the short date format is used.

Zenkin said Kaspersky Labs had received no reports of the worm in the wild yet. Microsoft did not respond to requests for comment at the time of posting.

Redesi.a selects an e-mail subject from the following list:

FW: Microsoft security update
FW: Security Update by Microsoft
FW: IT departments on state of HIGH ALERT
FW: Important news from Microsoft
FW: Stop terrorists computer viruses reign
FW: Terrorists release computer virus
FW: Emergency response from Microsoft Corp. FW: Terrorist Emergency. Latest virus can wipe disk in minutes
FW: Microsoft Update. Final Release Candidate
FW: New computer virus

Redesi.b selects its email subject from this list:

Kev Gives great orgasms to ladeez!! -- Kev
hell is coming for u, u will be sucked into a bottomless pit!!! -- Gaz
Scientists have found traces of the HIV virus in cows milk...here is the proof -- Will
Yay. I caught a fish -- Six
I don't want to write anything but Si is bullying me. -- Jim
I want to live in a wooden house -- Arwel
Michelle still owes me ?10 ...-- Si
Why have I only got cheese and onion crisps? I hate them !! -- Si
A new type of Lager / Weed variant...... sorted !
My dad not caring about my exam results -- by Michelle

By Matt Loney
ZDNet News