Destructive VBS Friend Virus Surfaces
As the ILOVEYOU virus saga continues to unfurl in the Philippines, Norman Data Defense Systems has warned of another visual basic (VB) virus that is spreading around the world.
The worm, known as "Friend Message," is not a variant on the original worm, but is a new and destructive one that appears to have been coded separately.
The firm said that the worm - known technically as VBS/[email protected], appears in a user's mailbox with a message header of "Friend Message," and uses a similar approach to the ILOVEYOU virus.
Norman Data Defense said that the virus has already been reported "in the wild" in a limited number, and has the potential to rapidly spread around the world.
The IT security specialist said that the worm is distributed as a file with the name Friend_Message.txt.vbs. If this file is executed, the worm becomes active, and immediately inserts commands in the user's AUTOEXEC.BAT file to delete all files in the Windows directory, the Windows System directory and the Windows Temp directory.
This routine, the firm says, is executed during next bootup cycle and will have the effect that Windows will be unable to run and must be reinstalled.
When it arrives, the worm displays a message box with the text:
"If you receive this message remember forever: A precious friend in all the world like only you! So think that!"
After this, when it executes, it proceeds to e-mail itself to all addresses in the user's MS-Outlook Address book.
The firm says that virus does not overwrite any files on the hard disk with itself, nor does it try to download anything from the Web, as is the case with the ILOVEYOU worm.
Norman Data Defense's Web site is at http://www.normanuk.com.
Reported by Newsbytes.com, http://www.newsbytes.com.