JS/Veruka-A is a JavaScript email and IRC worm.
JS/Veruka-A sends itself to email addresses found in Outlook address books.
JS/Veruka-A copies itself into the folders of any IRC clients found on the computer and creates initialisation files to send itself via the IRC network.
JS/Veruka-A deletes any BAT, LNK, PIF, CMD, HTM and VBS files it finds on the computer and replaces them with a simple command to run itself.
JS/Veruka-A creates copies of itself in the Windows folder and attempts to create the following registry entry to run itself automatically on log-on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
stmha
jilkx\wkfxi.js
JS/Veruka-A sends itself as an attachment to the following email message:
Subject:
[Warning]: Symantec Security Response E-mail Worm Warning
Message Body:
Dear Sir/Madam,We received few reports about a new e-mail worm.
The worm detected as W32.Holyshit.A@mm.
The attachment is the update for this worm.Please run it to update your
AntiVirus.
Attachment name:
Update.js