Very similar to the Melissa
virus from 1999
. This virus appears to have started on May 4, 2000
. Sending itself to 100% of people in a person's Outlook
address book. It is extremely widespread and has gone world wide in a matter of hours. Initial reports are that it originated from Asia
, maybe the Middle East
Just another example of why Outlook sucks. And makes every person that has been using e-mail from pre-outlook days wonder why Microsoft had to force this vile program onto the masses.
If you haven't heard of it yet, you soon will. I'm sure The Media will have a field day with this. It will probably be all we hear about for the next 48 hours. Oh Boy, I can hardly wait.
Even more: It copies itself to your system directory and to your windows (or winNT) directory. It then adds entries into the registry to start these up when you reboot. It then attempts to download the file WIN-BUGSFIX.exe from one of 4 random places if you have the file WinFAT32.exe. It copies itself over any vbs, vbe, js, jse, css, wsh, sct, or hta files changes the extenstion to vbs if it wasn't already. It also overwrites any jpg or jpeg files and renames them to the same thing appending the extenstion vbs. If it finds any mp3 files it creates a new file by the same name with a vbs extenstion, this new file is a copy of itself. If you have MIRC it modifies the script.ini file to send itself to people. It appears that when you join a channel it will send itself to anybody in that channel. It also does some other things with the registary that I'm not to sure about. Kurt "The Pope" has a writeup on it, but his website was /.ed before I could read it. Also the source code is now widely available since the programmer didn't do anything to try to hide it. Acording to the first 2 lines of it this virus came from Manila, Philippines by somebody going by the nick spyder.
I know this is an incomplete description I do not know VBScript nor MIRC very well.