Malware type: VBScript

Aliases: Email-Worm.VBS.Clown.a (Kaspersky), VBS/Devan@MM (McAfee), VBS.Ednav.B@mm (Symantec), Worm/Clown (Avira), VBS/Krusty-B (Sophos),

In the wild: No

Destructive: Yes

Language: Portuguese

Platform: Windows

Encrypted: No

Description: 
This destructive Visual Basic Script deletes files found in the "My Documents" folder. It propagates through VBS file infection and by sending itself over email via Microsoft Outlook.

It sends out an email with the following details:

Subject: Network Problem
Message Body: Due to the recent problems with the email server, we have devised a program that will fix it up. You are requested to download the attached file and execute it at once. The whole setup will take 5 to 10 minutes. If your system crashes, just restart your computer and everything will be back to normal.

Please follow instructions carefully.

System Administrator
Network Management.
Attachment: <infected VBS file>

It also propagates via Kazaa, a peer-to-peer application which allows users to share files over a network.

For additional information about this threat, see:
Solution
Technical Details

Description created: Sep. 4, 2002 2:59:31 PM GMT -0800
Description updated: Sep. 4, 2002 4:25:13 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.