Malware type: VBScript

Aliases: Email-Worm.VBS.Ipnuk.a (Kaspersky), MIRC/Generic (McAfee), VBS.Inker (Symantec), Worm/Ipnuk.A.1 (Avira),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP

Encrypted: No

Description: 

To get a one glance comprehensive view of the behavior of this worm, refer to the Behavior Diagram shown below.

Malware Overview

This Visual Basic script (VBscript) executes its propagation routine only during the months of January, June, and December. It can propagate through email messages and Internet Relay Chat (IRC).

The email it sends out contains the following details:

If the affected system's date is before the 15th of the month, it sends the following email:

Subject: Important Windows Security

Message Body:
Open the attachment to begin the windows update.
This update is very important to ensure your safety.

Microsoft
_______________________________________________________

If the affected system's date is the 15th and after the 15th of the month, it sends the following email:

Subject: Yo Wats Up There

Message Body:
Open the attached file to get
to the pictures you wanted.

This VBscript switches the functions of the affected machine's mouse buttons. It also changes the icons for such file types as MPEG, MP3, JPEG, and TXT.

This script also deletes the application Norton Antivirus from the Program files folder.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jun. 20, 2005 10:25:23 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.