VBS_REDLOF.A

This VBScript infects files by searching for all disk drives and subfolders for files that have any of the following file name extensions:

• VBS
• HTML
• HTM
• ASP
• PHP
• JSP
• HTT

To spread copies of itself, it infects the stationery file, BLANK.HTM, of Microsoft Outlook Express. Thus, this VBScript may spread through outgoing email messages, which may become infected.

It also takes advantage of the VM ActiveX Component vulnerability to propagate across networks. For more information regarding the said vulnerability, refer to the following Web page:

Microsoft Security Bulletin MS00-075

Related Items