Alias: VBS.Braco,
VBS/Braco.Worm
Category: VB Script
Type: Worm
Published Date: 2/3/2004
Last Modified: 2/3/2004
CHARACTERISTICS
VBS.Braco.E is a worm that spreads through e-mail. It uses Microsoft's CDO for NTS library, and therefore will usually only function on servers with IIS installed.
Method of Installation
When executed, VBS.Braco.E copies itself to the following locations:
%System%\patch.vbs
%System%\kernel.vbs
%System%\explorer.vbs
%Windows%\patch.vbs
%Windows%\winsck.vbs
%Temp%\patch.vbs
It also copies itself to the temporary folder using a randomly generated name consisting of 1 to 15 characters followed by .vbs, for example:
%Temp%\g.vbs
%Temp%\ipbr.vbs
%Temp%\pny7qnqmbqkq61a.vbs
These are the files attached to outgoing e-mails.
More: http://www3.ca.com/virusinfo/virus.aspx?ID=38163

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic