Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


SSIWG


Aliases:


SSIWG
I-Worm.SSWIG

Malware
Worm
VBS

Summary

VBS/SSIWG is a family of mass mailing worms generated with a virus construction kit.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


Variant:SSIWG.A@mm

When VBS/SSIWG.A@mm is executed, it copies itself to the Windows System directory as "Y072QWV.VBS". This file is also set to be executed in each system startup via following registry key:

  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

Next the worm copies itself to the root of each network drive, and sends itself to all recipients in all address books using Outlook. Messages that VBS/SSIWG.A sends have the following characterstics:

  Subject:    I'am missing U
    Body:       Could u remember me ?
    Attachment: Y072QWV.VBS

Note: The name of the attachment can be other that "Y072QWV.VBS".The worm uses a counter in the registry, so the mass mailing will happen only every 20th run.





Technical Details: Sami Rautiainen, F-Secure; August 2001



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free