Virus.VBS.AVM

Technical Details

WinScript.AVM is a family of parasitic viruses written in Windows Script language.

To replicate themselves they use File System Object (FSO). When run, the
viruses locate the host file name, read the file contents, locate their
body, search for all .VBS files in the Path directories and write
themselves to the end of files. The viruses also scan and infect .VBS files
the current directory as well as special directories: Desktop, MyDocuments,
Startup.

The viruses also create the AVM.VBS dropper file in the Windows directory
and register it in the system registry as the auto-run file. As a result,
the virus dropper will be automatically executed by Windows on each
rebooting.

The viruses contain the comments:

“AVM.a”:

Nick “The Love Monkey” Virus Package by ALT-F4 and ALT-F11

for the Alternative Virus Mafia

“AVM.b”:

…by ALT-F4 and ALT-F11 for the Alternative Virus Mafia