Worm.Win32.AimVen

The worm creates a copy of itself, called V.exe, in the C:\ root directory

c:\V.exe

The system attribute is ascribed to this file.

The worm then modifies one of the AOL Instant Messenger program files:

C:\PROGRAM FILES\AIM95\ICBMFT.OCM

The modification of ICBMFT.OCM means that when a user sends a file, a copy of the worm will be sent. This is achieved by intercepting file send procedures.

The interception procedure works in the following way: the extension of the file being sent will be replaced by an EXE extension. The worm then creates a copy of itself with the name of the original file, and returns control to the original file send procedure.

1. Delete the original worm file
2. Delete the copy of the worm: c:\V.exe
3. Re-install AOL Instant Messenger.
4. Perform a full scan of the computer (download trial version of Kaspersky Anti-Virus).

This network worm spreads via America Online (AOL) Instant Messenger (IM). The worm file is written in Assembler and is 8192 bytes in size.