Need help? Ask the community or hire an expert.
Go to Avira Answers
Size:2.195 Bytes 
Damage:Sent by email. 
VDF Version: 

DistributionWorm/Lee.SP spreads by email, using the Outlook Address Book. The email has the following structure:

Subject: Shakira's Pictures
Body: Hi: i have sent the photos via attachment have funn..
Attachment: ShakiraPics.jpg.vbs

Technical DetailsWhen the attachment is opened, the worm is copied as ShakiraPics.jpg.vbs in Windows directory and overwrites all .vbs files with its own code.

The worm copies itself in \Recycled\-folder on a local drive and sends itself over Microsoft Outlook. It can also spread by IRC, using the file Script.ini.

The worm enters the registry autostart key:
[HKEY_LOKAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]Registry=wscript.exe C:\Windows\ShakriaPics.jpg.vbs %

After infection, Worm/Lee.SP displays the message box:
"You have been infected by ShakiraPics Worm"
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .