Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
I-Worm.Aphex, Psec. Aplore.A
Worm/Aphex.3 makes a registry entry and prompts the user to download it.
The Visual Basic file "email.vbs" contains the damage routine and is attached to the virus email.
After the worm terminates the Outlook application, the script is deleted. The virus email looks like this:
The subject and body contain only ".".
When the worm is activated, it copies itself in Windows System directory as "explorer.exe". The registry entry
ensures the automatic start of the virus.
The worm has its own IRC engine and tries to connect to an IRC server. It connects to various ports and sends private messages to the users that try to connect to the server.
It offers a link to the infected computer. The site shows that a download should be performed in order to see the contents. The download is requested every second. After the user opens the file, the worm starts infecting the system.
Description inserted by Crony Walker on Tuesday, June 15, 2004