| VBS/VBSWG-AQ | ||||||||||||
| New VBS worm poses as Shakira's Pics | ||||||||||||
Script kiddies have again employed the "build a worm toolkit", Vbswg (a.k.a. the VBS Worm Generator), and released a new email and IRC (Internet Relay Chat) worm that overwrites VBE and VBS files on local and network drives with copies of itself. According to antivirus vendor Sophos, the VBS/VBSWG-AQ email has the following characteristics:
Upon infection, VBS/VBSWG-AQ also emails itself to all addresses contained in the Outlook address book and, if the IRC program mIRC is installed, the worm creates a script.ini file which spreads the worm via Internet Relay Chat as well. (Sophos detects the script.ini file as mIRC/Simp-Fam).
After spreading via emial and mIRC (if available), the worm creates additional registry entries:
HKCU\Software\ShakiraPics\mailed
HKCU\Software\ShakiraPics\mirqued
After overwriting files, the worm displays the message:
The toolkit used to create this particular worm is the same as was used to create the infamous AnnaKournikova worm which spread rapidly in February 2001.
|
||||||||||||
Explore Antivirus Software
Must Reads
About.com Special Features
Stay connected and entertained with reviews on tips on the latest HDTVs, cellphones and more. More >
Easy ways to connect two computers for networking purposes. More >
©2009 About.com, a part of The New York Times Company.
All rights reserved.