Tasin

infectionvectors.com

November 2004

Vector:      Email (attachment)

Impact:      Medium (Low distribution, deletes files from local disk)

Tasin (aka Inzae) arrives as a Spanish-language email with an attachment (ZIP extension) that attempts to delete multiple types of files from the infected hard disk. Although the worm does delete files from the local hard disk it is currently not in wide distribution, and should not be treated as a viral emergency. 

The files it attempts to delete include the following exceptionally popular formats:

asm 

asp 

bmp 

css 

doc  

gif 

htm 

html  

jpeg 

jpg

mdb 

xls

An email from this worm will appear like this:

Message: Documento interno danado, reinstale la aplication asociada para poder visualizarlo

Mas informacion http:/ /www.microsoft.com

El programa so cerrara.

Google Translation:

Message:  Internal document danado, reinstale aplication associated to be able to visualize it 

But information HTTP: / / www.microsoft.com 

the program under closed.

Attachments (one of the following):

Basta_YA.zip

Claro_que_lo_se.zip

Con_mas_amor.zip

Las_cosas_cambian.zip

Lo_que_te_mereces.zip

Lo_que_ves.zip

No_me_lo_creo.zip

Nunca_estamos.zip

Para_ti_mas.zip

Siempre_estas_ahi.zip

Some versions of the worm will display multiple fake error messages (also in Spanish). The third iteration of Tasin will open IE and display a picture of a nude woman.