Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

VBS.Braco.E

Feb 3, 2004 12:03AM PST

Alias: VBS.Braco,
VBS/Braco.Worm
Category: VB Script
Type: Worm
Published Date: 2/3/2004
Last Modified: 2/3/2004

CHARACTERISTICS
VBS.Braco.E is a worm that spreads through e-mail. It uses Microsoft's CDO for NTS library, and therefore will usually only function on servers with IIS installed.

Method of Installation
When executed, VBS.Braco.E copies itself to the following locations:

%System%\patch.vbs
%System%\kernel.vbs
%System%\explorer.vbs
%Windows%\patch.vbs
%Windows%\winsck.vbs
%Temp%\patch.vbs

It also copies itself to the temporary folder using a randomly generated name consisting of 1 to 15 characters followed by .vbs, for example:
%Temp%\g.vbs
%Temp%\ipbr.vbs
%Temp%\pny7qnqmbqkq61a.vbs

These are the files attached to outgoing e-mails.


More: http://www3.ca.com/virusinfo/virus.aspx?ID=38163

Discussion is locked