Threat Description



Category: Malware
Type: Worm
Platform: VBS
Aliases: Fool, MyPicture, Illen, The Thing


VBS/Fool is a VBScript worm that spreads itself via IRC client.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details


When the worm is executed it copies itself to the following locations:

	c:\windows\system\MyPicture.bmp.vbs 	c:\WINDOWS\Start Menu\Programs\StartUp\RunDLL.vbs 	c:\My Documents\MyPicture.bmp.vbs 	c:\MyPicture.bmp.vbs  

Then it replaces all .VBS files from the following directories with itself:

  c:\     c:\windows     c:\my documents     c:\windows\samples\wsh  

Then it replaces both "script.ini" and "mirc.ini" files from the "c:\mirc" directory. When another user joins to the same IRC channel where the infected user is, the worm will send itself. The message it sends looks like this:

  Hi. (server) (port) (ip address) (os) (time) (date) (channel name) it's     been (time) since my last reboot! Mil0.4b  

and it sends the file, "MyPicture.bmp.vbs".

Then the worm adds the following registry key:


This will execute the worm on the next reboot.

After that the worm creates a text file, "c:\Millennium.NFO" that contains the text below:

  Millennium 0.4b - mIRC/vBS     Fear the Millennium  

At December 31st, the payload activates showing a message box:

  Happy New Year!  

and changing the registered owner to "Millennium 0.4b", the registered organization to "uNF" and the product name to "Winblows 2000".

Then it replaces the "autoexec.bat". When the system is restarted, it shows a message:

	Your Computer is NOT Y2K Complient! 	Sorry For this Inconvenience 	Millennium 0.4b  

Finally this variant drops several files ("fix.txt", "fix.hex", "fix.bat", "lcoder.hex" and "short.src") to the current directory. Then the worm executes the "fix.bat" file.

The FIX.BAT file is a batch file that uses the standard DEBUG.EXE utility to create a binary from the Assembly source code file SHORT.SRC. Then the created SHORT.COM file is run. This file decodes the LOADER.HEX file into a binary LOADER.EXE. Then the LOADER.EXE is run and it processes the FIX.TXT file that instructs it to decode FIX.HEX into a binary FIX.EXE. Then the FIX.EXE is run and all dropped files are deleted.

The FIX.EXE file is a backdoor server (a hacker's remote access tool) called 'the tHing v1.6'. The backdoor's executable is compressed with an UPX file compressor. After being run the backdoor installs itself to system - it copies itself as EXPLOR.EXE into Windows directory and modifies SYSTEM.INI file so that it will be run during each Windows session. The backdoor adds its execution string after the 'shell=explorer.exe' tag.

When the backdoor is activated, it notifies its author about victim's presence on-line using a WWPMsg.dll library. The 'Victim is ONLINE' message is sent. Then the backdoor provides a limited access to the infected system for a hacker who has a compatible client part of this backdoor. It should be noted that the backdoor server is password-protected so it will accept connection only from a client that has the correct password.


This variant contains the following comments at the start of its code:

  'tHiS iS jUsT a BaCtErIa     'It wILL oNlI sPrEad~~     'Dun Worry     'Bacteria Grown By fox  

When the worm is executed, it copies itself to:

  C:\Windows\Important.txt.vbs     C:\Important.txt.vbs     C:\Windows\System\Important.txt.vbs     C:\My Documents\Important.txt.vbs  

Next VBS/Fool.G shows a messagebox:

  This is a very important message from Bill Gates     New Virus Will be out this season, look out for it!!  

The worm overwrites "c:\autoexec.bat", so files with the following extensions will be deleted from "C:\My Documents" directory: ".txt", ".mp3", ".bmp", ".jpg", ".gif", ".zip", ".exe" and ".wav". Also the following text will be displayed when the system is restarted:

  Important Message!!     Message From Bill Gates     New viruses is out this season!!!     Look Out!!!  

VBS/Fool.G uses mIRC to send itself when an infected user joins a channel using a file name "important.txt.vbs".

Next the worm drops a script to the Windows starup directory as "SpreadByADrive.txt.vbs". This script will, when the system is restarted, attempt to copy the worm to "A:\important.txt.vbs".

Finally it creates a text file to the desktop as "ImportantMessage.txt". The file contains the following text:

  Message From Bill Gates     Please be alert that there will be new virus be out this season     Please Look Out!!!     Pass this message to other people  

The worm also displays a message box:

  There will be a text file on your desktop     Please Read Carefully  

Technical Details:Katrin Tocheva, Sami Rautiainen and Alexey Podrezov, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More