The most award-winning anti-spyware software
Get serious about removing spyware with Spy Sweeper - the award-winning anti-spyware software trusted by millions of home computer users.
$29.95
Spyware & Virus Directory
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
VBS.Angel@mm
Risk Level 2: Low
SUMMARY
VBS.Angel@mm is a worm written in the Visual Basic scripting language. However, this worm also includes a 1122-byte variant of W95.CIH. When the worm is executed, it emails everyone in the Microsoft Outlook address book. It also creates and executes a file containing the virus W95.CIH. This variant of W95.CIH contains the payload that will damage the CMOS.
NOTE: Definitions prior to the March 23, 2001, detect the worm as VBS.Rewind.A@mm, and the W95.CIH variant is detected as Bloodhound.W32.EP.
Protection
- Virus Definitions (Intelligent Updater) March 23, 2001
Threat Assessment
Wild
- Wild Level: Low
- Number of Infections: 0 - 49
- Number of Sites: 0 - 2
- Geographical Distribution: Low
- Threat Containment: Easy
- Removal: Easy
Damage
- Damage Level: Low
- Large Scale E-mailing: Emails everyone in the Microsoft Outlook addressbook
Distribution
- Distribution Level: Medium
- Subject of Email: Read the true story on Angelina Julie
- Name of Attachment: AngelinaJulie.txt.vbs
- Size of Attachment: 8,552 bytes
TECHNICAL DETAILS
When VBS.Angel@mm is executed for the first time, it does the following:
- It copies itself to the Windows temp folder, usually C:WindowsTemp, as T4umhf5.vbs.
- It creates and then executes the file Ale32.exe. This file contains a 1122-byte variant of the virus W95.CIH. This infects the computer with W95.CIH.
NOTE: This file will not execute under Windows NT/2000.
- Next, it adds the value
T4umhf5.vbs
to the following registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoft
CurrentVersionRunServices
This causes the worm to be executed every time that Windows starts.
The worm does not check whether it has already emailed everyone in the Microsoft Outlook address book. Therefore, every time that the computer is restarted, the worm will email everyone in the Microsoft Outlook address book. The contents of the email message that this worm sends are:
Subject: Read the true history on Angelina Julie
Message:
Your life
Your work
Your lovers
Attachment: AngelinaJulie.txt.vbs.
REMOVAL
To remove the worm:
- Run LiveUpdate to make sure that you have the most recent virus definitions.
- Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
- If any files are detected as infected by W95.CIH, click Repair.
- Delete any files detected as VBS.Angel@mm.
Spy Sweeper 5.2 stops spyware in its tracks while offering home computer users the ability to configure the program to suit their specific needs, such as:
Choose a Quick, Full or Custom Sweep: With Spy Sweeper 5.2, you can easily choose to perform a quick, full or customized sweep. If you're looking for an immediate diagnosis, choose a quick sweep. For a pinpointed search, customize your sweep to have Spy Sweeper skip files by folder or file extension. For a deep cleaning, opt for a full sweep.
Exclude Files from a Sweep: Spy Sweeper allows you to save time during a sweep by skipping specific files or different sections of your PC. You can select specific file extension, such as .xls or .mpg to exclude.
Additional Highlights
As soon as it's installed, Spy Sweeper gives 360 degrees of protection against spyware, including:
Simple Sweeps: Detecting spyware and removing unwanted programs found on your computer in three effortless steps
Easy Management: Quickly and simply configure program, sweep and upgrade options
Fast Home: Use the home screen to access the most commonly used functions of Spy Sweeper
Shields Summary: A redesigned shields summary page makes it simple to see at a glance which shields are on or off
Action Alerts: Receive clear, easy-to-understand notifications when new spyware threats are detected
"Spy Sweeper remains a favorite for protection from spyware."
"This program's dominance is apparent as soon as you install it."
