Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Breberka

VBS/Breberka is a worm written in Visual Basic Script.  It spreads in the program Microsoft Outlook.  It arrives on computer as an email message with subject “IQ Test!!!" with the file "Breberka.txt .vbe " as attachment.  In the virus body there is text: "r u stupid? [Y/N] ;)))".  After the file in the attachment is activated the worm tests whether there is the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Breberka with value "...by gl" created in the system registry.  If this key does not exist the worm creates file winhelp.vbe in the directory where Windows is installed.  Further, it creates the files "Breberka.txt .vbe" and dropper.com in the subdirectory WINDOWS/TEMP.  Then, worm copies are sent to all addresses in the Outlook address book.  One copy is sent to the address breberka_counter@seznam.cz.  Finally the worm creates files dropper.com and autoexec.bat in the root directory on all disks and copies there also the file "Breberka.txt .vbe". This activity is performed without exception, i.e. also on computers that already have a key, serving as identification of infected computers, created in system registry. By creating the new file autoexec.bat the original one is definitely destroyed. This newly created autoexec.bat file contains an instruction to call the the file dropper.com which causes a computer restart. At the beginning of the worm code there are two lines with the following commentary:

'------
'Example of VBS i-worm for Mions e-zine #1

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.