This threat is detected as VBS/Pica.worm.gen. The virus may arrive as an email attachment JENNA-JAMESON-FREE-SUPERF***.TXT.vbs and will send an email using Outlook to all recipients in the Contact Folder in the following format:
- Subject: Jenna Jameson pornostar free superf***+photo addresses
- Body: Do you wanna see super pornostar,Jenna Jameson,in a special superf***? Double click on the attachment of this mail,and get also some interesting sex-sex-sex addreses... "
- Attachment: JENNA-JAMESON-FREE-SUPERF***.TXT.vbs
If the virus was executed from the A:\ or B:\ drive, it will copy itself to c:\x-F***.TXT.vbs. It then copies the following infected files to the Windows Directory: kernel32.vbs and JENNA-JAMESON-FREE-SUPERF***.TXT.vbs, ALEXIA.TXT.vbs to the Windows System Directory, and Natasa.TXT.vbs to the Windows Temp Directory. The following infected files can be created on A: or B: drive:
The following registry key is added so that the virus will run on the next boot up of the system:
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WUpdate kernel32.vbs
A text file JENNA-JAMESON-FREE-SUPERF***.txt is created in the Windows Directory and then opened in Notepad. VBS/Horty.a@MM also uses an infection counter in HKLM\SOFTWARE\WUpdate, and will send emails out 4 times from an infected machine. If the day is 13th of May, the virus will delete the Windows directory. If the day is 12th of May, the following message will be displayed:
This threat is detected as VBS/Pica.worm.gen. The virus copies itself as run32dll.vbs and clickme.vbs in %windows% directory. The virus will recurse through the Outlook Inbox and Sent Folder and resends these back to the sender. The subject is changed to "FREE PORN SITES" and attaches the file clickme.vbs. On 26 July, may display the message "FREE PORN SITES".