VBS/VBSWG.AQ Worm

 Information about the VBS/VBSWG.AQ worm:

VBS/VBSWG.AQ is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in Microsoft Outlook address book. It also spreads via MIRC.

It arrives with the following subject:

Shakira's Pictures

The body of the mail contains:

Hi :
i have sent the photos via attachment
have funn...

This mail contains an attachment ShakiraPics.jpg.vbs.

Upon execution of the infected attachment, it modifies Script.INI file under Mirc folder. A message box with the title VBScript and a message You have been infected by ShakiraPics Worm. The worm copies itself to Windows directory and deletes .VBS and .VBE files. After this the worm uses Microsoft Outlook address book to propagate itself.

The worm creates folder under following registry key.

HKEY_CURRENT_USER\Software

It also makes changes to registry at the following location to load itself at next system startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This worm first appeared on 26th May 2002.

 Other names of VBS/VBSWG.AQ worm:

This worm is also known as Shakira.