VBS/Elva - VBS script virus

See also

Summary Full description

Alias: I-Worm.Elva Type: Worm  Size: 7.174 Bytes  Origin:   Date: 08-25-2000  Damage: Sent by email.  VDF Version: 6.23.00.00  Danger: Low  Distribution: Low  Distribution The worm sends itself by email to all addresses found in Outlook. The email looks like this: Hello Jo, Happy birthday ELVA forever. This I made birthday card for you, Please open it and I hope you like. Technical Details The virus creates the file FS.VBE in C:\%WINDIR%\ and then copies it in C:\%WINDIR%\%SYSTEMDIR%\FS.VBS. It generates the following registry entries: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\FS "C:\WINDOWS\SYSTEM\FS.VBS" The virus is loaded by every system start. HKCU\Software\Microsoft\Office\9.0\Word\Security\Level "1" Sets the Word 9 security level to "low". HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201 "0" The current user can run ActiveX control items, which are not secure, on the local computer. HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201 "0" Unsecure ActiveX control items can be run on the local computer. HKLM\Software\Microsoft\FSD; HKLM\Software\Microsoft\FSW Here the current day is saved. HKLM\Software\Microsoft\FSH; HKLM\Software\Microsoft\FSV The complete virus code is saved here. The file CARD.HTA is attached and sent to all entries in MS Outlook Address Book. The Internet address "http://www.jasonnet.cc/elva" is sent to Favourites, as "Elva's Page". The worm searches for all VBS files and replaces their code with its own. Then, it links to Windows scripting host all the files of type: *.JS; *.JSE; *.GIF; *.JPG; *.MP3; *.WSH; *.WSF; *.WSC; *.SHS; *.SCT. These files will then be treated as VBS files. The virus infects the Word templates. A small programming error prevent the infection of all Word documents. But it is to be expected that newer versions of the virus will correct this error. A window will show the following message: "Happy Birthday" Three days after the virus is activated, it scans the harddisk. It will overwrite its virus code in the files with extension: *.JS; *.JSE; *.GIF; *.JPG; *.MP3; *.WSH; *.WSF; *.WSC; *.SHS; *.SCT. On August, 24th. of any year, the following message appears on the screen: .=Happy birthday=. I love ELVA 4 ever See a brief description here. Inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

« Back