VBS_SOLOW.V

This VisualBasic (VB) Script arrives on a system as a dropped file of other malware. It also arrives via network and removable drives.

Upon execution, it drops copies of itself as KERNEL32.DLL.VBS in the Windows system folder and in the root folders of drives C to Z. It also drops an AUTORUN.INF file in the same drives to automatically execute the dropped copies when the drives are accessed.

To ensure automatic execution at every system startup, it creates a certain registry entry. It also adds a particular registry entry, which changes the text displayed in the title bar of Internet Explorer.

It requires the presence of the normal file WSCRIPT.EXE to execute properly.

Related Items