Trend Micro Virus Alert - VBS_IPNUKER.A

VBS_IPNUKER.A is a non-destructive, non-memory resident worm that propagates only during the months of January, June, and December. It can propagate through email messages and Internet Relay Chat (IRC). This worm is currently spreading in-the-wild and infecting systems that run Windows 98, ME, NT, 2000, XP.

Upon execution, this VBscript switches the functions of the affected machine's mouse buttons and changes the icons for such file types as MPEG, MP3, JPEG, and TXT. It also deletes the application, Norton Antivirus, from the Program files folder.

It uses MAPI commands to propagate itself and to gather email addresses stored in the affected system. It then sends out an email to the gathered addresses.

Upon arrival, this Visual Basic script (VBscript) drops the following files:

%Windows%\favorites\ipnuker.url
%Windows%\ipnuker.vbs
C:\mirc\ipnuker.vbs

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It also creates a registry entry to enable its execution at every system startup and deletes these types of files: .BAT, .TXT, and .VBS.

If you would like to scan your computer for VBS_IPNUKER.A or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at:http://housecall.trendmicro.com/

VBS_IPNUKER.A is detected and cleaned by Trend Micro pattern file #2.700.08 and above.