Name :	Email-Worm:W32/VB.BI
Detection Names :	Email-Worm.Win32.VB.bi
Category:	Malware
Type:	Email-Worm
Platform:	W32

A worm that spreads via e-mail, usually in infected executable e-mail file attachments.

Special Disinfection Tool

F-Secure Corporation provides a special disinfection utility to clean VB.bi infection from a computer. This disinfection utility is called F-Force and it can be downloaded from our ftp site:


The utility is distributed only in a ZIP archive that contains the following files:


To unpack the archive please use WinZip or similar archiver.

IMPORTANT! Please make sure that you read the End User License Terms document (Eult.rtf) and the Readme file (either Readme.txt or Readme.rtf) before using the F-Force utility!

The F-Force utility needs the archive with the latest updates in order to function properly. The archive's name is LATEST.ZIP and it should be downloaded and put into the same folder where the F-Force utility is located. This archive with the latest updates can be downloaded from these locations:


Please note that the F-Force utility can disinfect only certain malicious programs. Besides the utility does not scan inside archives. So after cleaning a computer with the F-Force utility it is recommended to scan all hard drives with F-Secure Anti-Virus and the latest updates to make sure that no infected files remain there.

Email-Worm:W32/VB.BI is a mass-mailing worm that also tries to spread using remote shares. It also tries to disable security-related software.

The worm attempts to disable several security-related programs.


Installation

Email-Worm.Win32.VB.bi is written in Visual Basic and compiled as p-code. The size of the main executable is about 95 kilobytes. When executed, it first copies itself to several locations:


where '%Windows%' presents the system Windows folder. In Windows XP systems, it is usually C:\WINDOWS. '%System%' is the system32 folder.

The worm installs the following registry key for ensuring it will be started on system startup:



Propagation (E-mail)

The worm collects e-mail addresses from files with following extensions:


And from the files with the following string in name:


The worm sends itself as attachment in the infected e-mail.

The e-mail subject is one the following:


The message body may be one of the following:


The worm can attach itself as executable file. It uses one the following names in attachment:


Sometimes, the worm MIME-encodes the file. In these cases, the attachment name can be one of the following:


The filename inside MIME-encoding is one of the following:



Propagation (Shared Folders)

The worm searches for remote shared folders and tries to copy itself using one of the following filenames: