Email-Worm.Win32.Melting or Melting (also known as MeltingScreen) is a worm on Microsoft Windows that masquerades as a screensaver. Instead of being just a screensaver, the worm activates very maliciously. Given that the worm pretends to be something else while hiding the malware code, it bears some similarities to a trojan.
This virus-worm spreads via the Internet. The worm itself is a Win32 PE EXE file about 18KB in length, and it is written in VisualBasic. It is transferred via the net in Email messages with infected attachments with the "MeltingScreen.exe" name.
When an infected message is received and the attached executable is ran, the worm will gain control and start its spreading routine. This routine connects to Microsoft Outlook, enters the address book, obtains Internet addresses from there and sends messages by using these addresses.
The messages have a copy of the worm in the attachment with the Subject "Fantastic Screensaver", and the message body appears as follows:
Hello my friend ! Attached is my newest and funniest Screensaver, I named it MeltingScreen. Test it and tell me what you think. Have a nice day my friend. p.s.: Please install the Runtime Library for VB 5.0, before you run the ScreenSaver.
Every time the worm is ran, it would gain access to the Windows directory and renames an EXE file to BIN, followed by placing itself to the original filename. The worm has bugs and often hangs a computer when ran.
The worm activates by random, it "melts" the screen. Once it has been triggered, this effect will always run when it is loaded.
If the Visual Basic Runtime Library does not present on the infected system, it will never be triggered.