Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Sent by email.
Worm/Lee.SP spreads by email, using the Outlook Address Book. The email has the following structure:
Subject: Shakira's Pictures
Body: Hi: i have sent the photos via attachment have funn..
When the attachment is opened, the worm is copied as ShakiraPics.jpg.vbs in Windows directory and overwrites all .vbs files with its own code.
The worm copies itself in \Recycled\-folder on a local drive and sends itself over Microsoft Outlook. It can also spread by IRC, using the file Script.ini.
The worm enters the registry autostart key:
[HKEY_LOKAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]Registry=wscript.exe C:\Windows\ShakriaPics.jpg.vbs %
After infection, Worm/Lee.SP displays the message box:
"You have been infected by ShakiraPics Worm"
Description inserted by Crony Walker on Tuesday, June 15, 2004