Oslo, 6 June 2002  

Norman ASA, a world leader in the field of data security warns today of a new fast spreading e-mail worm which the industry has named VBS/VBSWG.AQ@mm. The mail presents itself as pictures of pop star Shakira thereby trying to use the same trick to fool users as in, the well known Anna Kournikova virus. The real content however is a program that will overwrite all .VBS and .BE files on the infected system.

This is an encrypted email, network and IRC worm written in VB script. It is created by the worm creation tool Visual Basic Script Worm Generator (VBSWG). The worm is a standard mass mailer. When run, it copies itself to the Windows directory, and adds a registry entry to ensure that it is run from startup. It will now call up Outlook and send itself to all users in the Outlook address book; after this it will look for a mIRC installation, and create a file in the MIRC directory that will direct the IRC client to send the worm on to other users on IRC. After this is will traverse local and remote drives it has access to and overwrite all *.VBS and *.VBE files with itself.

General characteristics

Type: Worm Spreading mechanism: Email, network, IRC

Email characteristics

Subject: Shakira's Pics

Body:

Hi : i have sent the photos via attachment have funn...

Attachment: ShakiraPics.jpg.vbs

Destructivity

Low

Payload

Displays message

Detection and removal

Norman Virus Control with definitions files from May 29th or later detects and removes this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version.

For detailed Information about this threat visit: www.norman.com

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76