VBS/SST.A - VBS script virus

See also

Full description

Alias:
Type:	Worm
Size:
Origin:
Date:	02-13-2001
Damage:	Emailversand
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Low

DistributionThe worm sends itself by email, to addresses found in Outlook. The email looks like this:
Subject: Here you have ;o)
Body: Hi: Check This!
Attachment: AnnaKournikova.jpg.vbs

Technical DetailsWhen activated, the worm makes the following registry entry:
HKCU\Software\OnTheFly
with the text
Worm made with Vbswg1.05b
This is the worm's signature.

First, the worm copies itself in Windows directory (usually C:\Windows) as: AnnaKournikova.jpg.vbs.
After sending the emails, the worm makes a second registry entry:
HKCU\Software\OnTheFly\mailed
with the value "1".

The messages are immediately deleted, after they are sent and do not appear in "Sent Items" folder.

The worm's code has another routine, too: on every January, 26th, it opens the Internet site http://www.dynabyte.nl. This is the site of a Netherlads computer magazine.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back