|
Friday, 21 January 2005 |
VBS.Swerun is a VBScript virus that attempts to overwrite all .vbs files on all drives with a copy of itself.
Type: Virus
Infection Length: 1,986 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
When VBS.Swerun is executed, it performs the following actions:
Attempts but fails to overwrite files with the following extensions:
.htm
.html
.shtml
Attempts but fails to search for files with extensions:
.bmp
.jpg
.gif
.ico
to create a file with the same name with .vbs as a second extension.
Modifies all .vbs files to 1,986 bytes in length by overwriting the original file with a copy of the virus..
Adds the value:
"Win32" = "C:windowssystem32.vbs"
to the registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
Note: The virus does not create the file C:windowssystem32.vbs
|
