VBS/Edibara-A is a visual basic script virus.
VBS/Edibara-A will attempt to modify files with htm and html extensions and include a segment of VBScript which will drop a copy of the virus on computer which read the infected htm/html file.
The script will also drop the following files:
<system32>/TPS32E.dll
<system32>/TPS32V.dll
<system32>/Systemv.dll
<system32>/Kernel.exe
<system32>/Kernel.vbs
All of which are detected by VBS/Edibara-A.
VBS/Edibara-A will autostart itself by setting the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Windows
<system32>\Kernel.vbs
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Microsoft Windows
<system32>\Kernel.exe
VBS/Edibara-A will also obtain your email address from Yahoo! Pager information and send an email to your account, with the subject line "Hello", prompting you to visit certain website.
Kernel.exe is a component which will download and execute a file from remote server.