Malware type: VBScript

Aliases: IRC-Worm.HTML.Generic (Kaspersky), VBS/Valentin@MM (McAfee), VBS.Valentin@mm (Symantec), Worm/LL.Valentine (Avira), VBS/San-A (Sophos), Virus:VBS/Valentin.A@mm (Microsoft)

In the wild: Yes

Destructive: Yes

Language: English

Platform: Windows 9x/2000

Encrypted: Yes

Description: 
This worm is encrypted in an HTML file and uses the script language VBScript Encode format. This worm comes embedded in an email with no subject, message body or attachment. It propagates via MS Outlook and also sends messages to mobile phones. If the current system date is 8, 14, 23, or 29, this worm renames all files in the C:\ drive by adding a .TXT extension to all. Then it overwrites the contents of the renamed files with some text in Spanish. This worm may also use mIRC

Trend advises all email users to exercise caution and not open email with suspicious subject headers and unsolicited attachments. Please disable the preview pane in MS Outlook to avoid spreading this virus because it contains embedded HTML code that installs this Internet worm. To avoid execution of malicious scripts, Windows Scripting host should be removed on the Windows environment.

For additional information about this threat, see:
Solution
Technical Details

Description created: Feb. 13, 2001 12:21:32 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.