winsock.vbs - Dangerous
winsock.vbs
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
This Internet worm spreads via e-mail messages using MS Outlook and IRC, and is written in VBS.
The IRC scripts are needed for spreading via the IRC channel.
Then the worm activates a spread procedure, opening the MS Outlook address book, and for each address, creating the following message:
Subject: Hello ;]
Body: Hi , check out this game that j sent you (funny game from the net:]).
Attach: dragonball.vbs
The worm contains errors, and this procedure can't work correctly. So, the worm can't spreads via e-mail.
In conclusion, the worm displays the following dialogue box:
When a user closes this box, the worm removes keyboard and mouse functions, and the runs MediaPlayer with a file from the Internet:
http://bdball.metropoli2000.net/mmedia/v...
and changes AUTOEXEC.BAT, inserting the strings:
@ECHO ON
ECHO DraGon Ball [Z] by YuP
ECHO Thank you and bye bye dragon world!!
Please, remove it with RegRun.