Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Likon is a worm written in Visual Basic Script.  It comes from Russia and it is proved by texts in Cyrillic at the beginning of the worm body.  It's peculiarity lies in the fact that it uses  "file streams" of the NTFS file system.
This worm consists of four modules.  The first of them takes care of spreading and the other three create a user with name Lord_Nikon in Windows 2000.  The worm should grant this user the rights of the system administrator, but this operation is not successful because of a typing error in the code.
The worm spreads as an email message with subject "New Generation of drivers".  In the message body is the following text:

Microsoft has published new driver for all types Video Cards, compatible with Windows 95/98/NT/2000/XP.
You can read about it in attachment document.
Best wishes,
Microsoft.

In the attachment of such message is the file driver.doc .vbs (number of spaces in the name is only illustrative).  When the attachment is opened the worm copies itself to the directory in which the operating system Windows is installed.  After that it sends an email message with the worm copy in the attachment to the first 50 contacts from the Outlook address book.  There are copies of the worm in files odbc.ini and \system32\go.vbs on the disk as well as in the directory in which Windows are installed.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.