VBS.Plan

 Information about the VBS.Plan:

VBS.Plan is a rapidly spreading email worm, similar to the Lovetter. This worm spreads through MS-Outlook. The infected mail would have a randomly generated subject, body and attachment as shown below:

Subject: US PRESIDENT AND FBI SECRETS =PLEASE VISIT => (http://WWW.2600.COM)<=.

Body:    VERY JOKE..! SEE PRESIDENT AND FBI TOP SECRET PICTURES.. .

Attachments : *.gif.vbs
                     *.bmp.vbs
                     *.jpg.vbs

The attachments can have any alphabet picked from the character set A, E, I, O, U as the file name. Opening any of the above attachment launches the worm copying itself in the following folders

WINDOWS\reload.vbs
WINDOWS\SYSTEM\<a random file name is given>
WINDOWS\SYSTEM\LINUX32.vbs

Registry modifications are done at the following locations :

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\

This worm checks for the existence of WINFAT32.EXE file, if found it changes the settings of the Internet Explorer to download the following files

macromedia32.zip
linux321.zip or linux322.zip.

This worm would automatically connect to the internet to send MAPI emails to the recipients found in the address book. The mail contains a randomly picked subject, body and an infected attachment. The worm
overwrites the files found with the following extentions and adds .VBS to them

.Vbs
.Vbe
.js
.jse
.css
.wsh
.sct
.hta
.jpg
.jpeg
MP2
MP3

Mp2 and Mp3 file attributes are modifyed to hidden by this worm.

The worm displays the following message on September 17 :

Dedicated to my best brother=>Christiam Julian(C.J.G.S.) Att. (M.H.M. TEAM)

Later this worm disconnects all the mapped network drives in the network.

VBS.Plan first appeared in June 2000.

 Other names of  VBS.Plan:

This virus is also known as Plan

 Removing VBS.Plan from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.