VBS/SST.A - VBS script virus

Siehe auch

Vollständig

Alias:
Type:	Worm
Size:
Origin:
Date:	02-13-2001
Damage:	Emailversand
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Low

DistributionThe worm sends itself by email, to addresses found in Outlook. The email looks like this:
Subject: Here you have ;o)
Body: Hi: Check This!
Attachment: AnnaKournikova.jpg.vbs

Technical DetailsWhen activated, the worm makes the following registry entry:
HKCU\Software\OnTheFly
with the text
Worm made with Vbswg1.05b
This is the worm's signature.

First, the worm copies itself in Windows directory (usually C:\Windows) as: AnnaKournikova.jpg.vbs.
After sending the emails, the worm makes a second registry entry:
HKCU\Software\OnTheFly\mailed
with the value "1".

The messages are immediately deleted, after they are sent and do not appear in "Sent Items" folder.

The worm's code has another routine, too: on every January, 26th, it opens the Internet site http://www.dynabyte.nl. This is the site of a Netherlads computer magazine.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück