VBS/VBSWG.AQ@mm

[Technodrome]

Name: VBS/VBSWG.AQ@mm
Aliases: Shakira's Pics
Type: Internet Worm
Discovery Date: 06 June 2002

Description:

VBS/VBSWG.AQ@mm is an encrypted worm written in VBScript. This worm arrives as an email containing the following information:

Subject: Shakira's Pics
Message: Hi : i have sent the photos via attachment have funn...
Attachment: ShakiraPics.jpg.vbs
When this attachment is double clicked, the worm is executed and it will copy itself to the Windows System directory.

A message is then displayed with the following text:

You have been infected by the ShakiraPics Worm
VBS/VBSWG.AQ@mm will also email a copy of itself to recipients in the Microsoft Outlook address book.

source: http://www.command.co.uk


Technodrome

[Bouch]

Thanks for the info Technodrome. Of course, if one has a firewall that would rename the file because of the vbs extension, or a program like Script Sentry or, better still, Wormguard that would jump on the file because of two file extensions, I suppose that it wouldn't represent that much of a threat. Regards.

See also:

http://www.security-pro.co.uk/yabb/YaBB.pl?board=virusesworms;action=display;num=1023310540

[Technodrome]

Thanks for the info Technodrome. Of course, if one has a firewall that would rename the file because of the vbs extension, or a program like Script Sentry or, better still, Wormguard that would jump on the file because of two file extensions, I suppose that it wouldn't represent that much of a threat. Regards.

Simply, you are right Bouch !


Technodrome

[Checkout]

Strange, I've been getting this one for a while but didn't realise it was a nasty - simply because I delete stuff I'm obviously not interested in! *I wonder how many other nasties I've avoided through disinterest in the subject line? *

[Bouch]

I wonder how many other nasties I've avoided through disinterest in the subject line?

Any way to avoid them is a good way. Let's hope that the writers of nasties do not become more imaginative when creating subject lines. Dull and uninteresting works for me.