Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Newlove is a worm written in the script language VBS (Visual Basic Script).  It was created by modification of the worm VBS.LoveLetter.  After its installation it sends out its copies to all addresses saved in the address book of the program Microsoft Outlook.
A message containing the copy of this worm has the subject "FW:  followed by a random filename consisting of 1 to 30 capital letters.  As extension of this file the worm chooses one extension of the following list: Doc, Xls, Mdb, Bmp, Mp3, Txt, Jpg, Gif, Mov, Url, Htm and Txt. Subject of the message can be for example:

FW: INOUTGBUIPGNMOM.Gif

There is no text in the message body.  The message contains in its attachment a file of the same filename as from the message body but with the extension VBS added.  When the attachment is run the worm is activated.  This worm contains a destructive payload overwriting files on all accessible disks by the virus copy.  It adds the extension VBS to files destroyed in this way.  It means that a file named "TETRIS.EXE" will be named "TETRIS.EXE.VBS" after the worm destroys it.
The worm uses a simple polymorphic algorithm – after every infection, lines with a random commentary are inserted into its source text.  Example:

'QHISGJQVFMGZMYXLCKDFSGLIRQBM
Set regedit = CreateObject("WScript.Shell")
'QWEMXQVHETUKUXBWMQQQSELAGGOQRNAEWNOYMPVUSFFSWDRBQCLYL

This causes a gradual increase of the worm length. It can reach a length of even several MB.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.