WORM_VB.ZAA

This worm arrives as a file dropped by other malware. It can also be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself.

It then executes Windows Media Player and displays the following message:

This worm modifies a certain registry entry to hide file extension names. It also hides files with System attributes by modifying another registry entry.

It drops copies of itself in all removable drives. It also drops a certain file to automatically execute its dropped copies when the said drives are accessed.

Related Items