Email-Worm.VBS.Decbel

Technical Details

This worm spreads via the Internet as an attachment to infected messages. Infected messages will be sent to all email addresses harvested from the victim machine.

It is written in Visual Basic Script (VBS). It is 562 bytes in size.

Payload

The worm uses MS Outlook to send email to all addresses from the address book.

The worm uses MS Outlook to send email to all addresses from the address book.

Infected messages:

Message subject:

"DecBel (ANNA) - JUILLET 2000."

Message body:

"Bonjour ! Voici DecBel (ANNA) ! C'est un décodeur Canal+ Belgique. Consultez la documentation attachée a cet e-mail pour en savoir plus a son sujet... Ne le lancez pas sans le passer a l'antivirus !"

Attachment name:

DecBel.txt

decbel2.exe

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
2. Delete all infected messages from all mail folders.
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus.