Fandom

Malware Wiki

TripleSix

1,320pages on
this wiki
Add New Page
Comments0 Share

Worm.VBS.TripleSix, also known as TripleSix, 666test, VanHouten, or by the misnomer Virus.VBS.TripleSix, is a worm on Microsoft Windows written in Microsoft Visual Basic Scripting Edition.

BehaviorEdit

On execution, the script displays a message explaining that it will calculate the sum of the ASCII values of the characters entered, the idea being that the user enters their name to see if it adds up to 666 (hence the name TripleSix).

It then creates a text input prompt, and when OK is pressed it will act as described:

TripleSix2ndMessageBox

TripleSix3rdMessageBox

If the user cancels or does not enter any text, the worm will stop asking for input and begin to replicate itself. Using PKZIP, it will create a zipped copy of itself by the name "666TEST.ZIP" in the Windows directory. It then drops a second file, "REGSVR.VBS", in the System directory and sets it to run on startup.

The worm will then scan for IRC clients in the following directories:

\MIRC

\MIRC32

\PIRCH

\PIRCH98
TripleSix Sad Face

VANHOUTEN.BMP

Upon finding mIRC, Pirch, or Pirch98 in one of these directories, it will modify the client's setup files to send 666TEST.ZIP to anybody who joins the same IRC channel as the infected user. If run on the fifth of any month, the script will also drop a picture of Milhouse van Houten from The Simpsons as "VANHOUTEN.BMP" and set it as the user's wallpaper.

The first time it is run, the script will also mass-mail 666TEST.ZIP using Microsoft Outlook. The subject line of the message is "666 test" and the message body is:

"> Does your name add up to 666 in ASCII characters? Are you going to go to hell?"

After mass-mailing, the worm sets the following registry key to ensure that it will not mail itself again on subsequent startups.

"HKEY_LOCAL_MACHINE\Software\MIRC/OUTLOOK/PIRCH.VanHouten\" = "True"

VideosEdit

Virus.VBS01:25

Virus.VBS.TripleSix

Virus.VBS.TripleSix by Alles

TripleSix Windows Worm01:28

TripleSix Windows Worm

Virus.VBS.TripleSix by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.