Category: Viruses and SpywareProtection available since:18 Dec 2007 16:02:38 (GMT)
Type: Visual Basic Script wormLast Updated:18 Dec 2007 16:02:38 (GMT)
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

VBS/Poly-A is a Visual Basic Script email-aware worm.

This polymorphic encrypted worm searches the infected computer's local and networked drives for .JPG and .JPEG files. If the search is successful it will attempt to determine by the filenames whether they might include illegal sexual images of children.

If the worm believes it has found illegal images it will attempt to send an email to one of the following recipients:


The message sent by the worm will have the following characteristics:

Subject: RE: Child Pornography

Message body:
Hello, this is Poly Pedo Worm. I have found a PC with known Child Pornography files on the hard drive. I have included a file listing below and included a sample for your convenience.


Message body:
Hello, this is Antipedo 2001. I have found a PC with known Child Pornography files on the hard drive. I have included a file listing below and included a sample for your convenience.

Before May 1 2001 the worm forwards itself in an email to everyone in your address book with a random subject, random message body text and random filename (although the filenames always end .txt.vbe or TXT............vbe

After May 1 2001 the worm forwards itself in an email to everyone in your address book as an email with the following characteristics:

Subject: You Are Currently Under Investigation

Message body:
I have been informed that you are currently under investigation for possession of child pornography. Please read the attached document for more information.

Attached filename: Know The Law.txt.vbe


Subject: FWD: help us ALL to END ILLEGAL child porn NOW

Message body:
Hi, just a quick e-mail. Please read the attached document as soon as you can. Thanks.

Attached filename: END ILLEGAL child porn NOW.TXT............vbe

VBS/Poly-A attempts to change Internet Explorer's start page and makes changes to the Windows Registry.

While VBS/Poly-A is scanning your hard drive for potentially illegal pornographic material it displays the following text in Windows Notepad:

"In 1977 the Sexual Exploitation of Children Act (18 U.S.C. 2251-2253) was enacted. The law prohibits the use of a minor in the making of pornography, the transport of a child across state lines, the taking of a pornographic picture of a minor, and the production and circulation of materials advertising child pornography. It also prohibits the transfer, sale, purchase, and receipt of minors when the purpose of such transfer, sale, purchase, or receipt is to use the child or youth in the production of child pornography. The transportation, importation, shipment, and receipt of child pornography by any interstate means, including by mail or computer, is also prohibited
The Child Protection Act of 1984 (18 U.S.C. 2251-2255) defines anyone younger than the age of 18 as a child. Therefore, a sexually explicit photograph of anyone 17 years of age or younger is child pornography. On November 7, 1986, the U.S. Congress enacted the Child Sexual Abuse and Pornography Act (18 U.S.C. 2251-2256), that banned the production and use of advertisements for child pornography and included a provision for civil remedies of personal injuries suffered by a minor who is a victim. It also raised the minimum sentences for repeat offenders from imprisonment of not less than two years to imprisonment of not less than five years.
On November 18, 1988, the U.S. Congress enacted the Child Protection and Obscenity Enforcement Act (18 U.S.C. 2251-2256) that made it unlawful to use a computer to transmit advertisements for or visual depictions of child pornography and it prohibited the buying, selling, or otherwise obtaining temporary custody or control of children for the purpose of producing child pornography.
On November 29, 1990, the U.S. Congress enacted 18 U.S.C. 2252 making it a federal crime to possess three or more depictions of child pornography that were mailed or shipped in interstate or foreign commerce or that were produced using materials that were mailed or shipped by any means, including by computer.
With the passage of the Telecommunications Act of 1996, (18 U.S.C. 2422) it is a federal crime for anyone using the mail, interstate or foreign commerce, to persuade, induce, or entice any individual younger than the age of 18 to engage in any sexual act for which the person may be criminally prosecuted.
The Child Pornography Prevention Act of 1996 amends the definition of child pornography to include that which actually depicts the sexual conduct of real minor children and that which appears to be a depiction of a minor engaging in sexual conduct. Computer, photographic, and photocopy technology is amazingly competent at creating and altering images that have been morphed to look like children even though those photographed may have actually been adults. People who alter pornographic images to look like children can now be prosecuted under the law."