VBS.Vabi@mm
It is a mass-mailing worm that infects .frm, .cpp, and .pas files.
Creates a link on the desktop, named "Sex-Children.jpg" that links to %Windir%\Vabian.VX, by creating the file, C:\Documents and Settings\All Users\Desktop\Sex-Children.jpg.lnk.
Searches for and infects the files with the following extensions: .frm; .cpp; .pas
Searches for the files with .bmp, .gif, and .ico extensions.
If files are found, the worm copies itself as [filename].[extension].VX or [filename].[extension].bat.
For example, "file1.jpg.VX" or "file1.jpg.bat"
Adds the text "VabianMarker" to the end of each infected file.
Sends itself to all the addresses in the Microsoft Outlook address book.
The email has the following characteristics:
Subject: Vabian Milenium
Message body: Stop asking,just checkout the attachment
Attachments: %windir%\Vabian.vbs
Manual removal:
Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vabian
and delete the value: "wscript.exe" = "%windir%\vabian.vbs"
Also navigate to and delete the key: HKEY_CLASSES_ROOT\VXFile
Removal: vabian.vbs is removed by RegRun.
Read more... Removal instructions...
Recommended software:
UnHackMe - easy removal Rootkits/Adware/Spyware.
http://www.unhackme.com
RegRun Security Suite - removal and protection.
http://www.regrun.com
RegRun Reanimator - free removal tool.
greatis.com/reanimator
RegRun - User's Choice
Vista Programs - full info...
What is hidden in MSDN?
.NET Secrets Revealed
Why software developers prefer Win32.FreeTechSecrets.com?
All Unix Manuals in Alphabetical Order
C# controls for .NET in 3 simple steps.
Constantly updated. Last update:
May 12 2008
Interesting information about Vista programs...
Need consultation?
Would you like to add your opinion?