Summary
Summary
Action- More Information
| Included in our products from | July 2002 (3.59) |
|---|---|
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please read the instructions for removing worms.
Windows NT/2000/XP
In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Registry
and delete it if it exists.
Close the registry editor.
More Information
VBS/VBSWG-AQ is an email worm. The worm spreads using an email with the following characteristics:
Subject line: Shakira's Pics
Message text:
Hi :
i have sent the photos via attachment
have funn...
Attached file: ShakiraPics.jpg.vbs
When the attachment is run it will copy itself into the Windows folder and add the registry entry
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Registry
to ensure that the worm is run each time Windows is started. It will then attempt to email itself to all addresses listed in the Microsoft Outlook address book. If the worm detects that mIRC is installed it will create the file script.ini in the mIRC folder. This file is detected by Sophos Anti-Virus as mIRC/Simp-Fam.
VBS/VBSWG-AQ will also create the registry entries
HKCU\Software\ShakiraPics\mailed
and
HKCU\Software\ShakiraPics\mirqued
after it has attempted to spread by email and IRC.
The worm will then search all local and network drives for files with VBE or VBS extensions and overwrite them with a copy of itself.
Finally the worm will display the message
"You have been infected by the ShakiraPics Worm".
|
