Very similar to the
Melissa virus from
1999. This virus appears to have started on
May 4, 2000. Sending itself to 100% of people in a person's
Outlook address book. It is extremely widespread and has gone world wide in a matter of hours. Initial reports are that it originated from
Asia, maybe the
Middle East.
Just another example of why Outlook sucks. And makes every person that has been using e-mail from pre-outlook days wonder why Microsoft had to force this vile program onto the masses.
If you haven't heard of it yet, you soon will. I'm sure The Media will have a field day with this. It will probably be all we hear about for the next 48 hours. Oh Boy, I can hardly wait.
More info: it apparently has a nasty payload too. It messes with MIRC to replicate itself further. It traverses your drives and copies itself over any JPEGs, MP3s, javascript files, and more.
Even more: It copies itself to your system directory and to your windows (or winNT) directory. It then adds entries into the registry to start these up when you reboot. It then attempts to download the file WIN-BUGSFIX.exe from one of 4 random places if you have the file WinFAT32.exe. It copies itself over any vbs, vbe, js, jse, css, wsh, sct, or hta files changes the extenstion to vbs if it wasn't already. It also overwrites any jpg or jpeg files and renames them to the same thing appending the extenstion vbs. If it finds any mp3 files it creates a new file by the same name with a vbs extenstion, this new file is a copy of itself. If you have MIRC it modifies the script.ini file to send itself to people. It appears that when you join a channel it will send itself to anybody in that channel. It also does some other things with the registary that I'm not to sure about. Kurt "The Pope" has a writeup on it, but his website was /.ed before I could read it. Also the source code is now widely available since the programmer didn't do anything to try to hide it. Acording to the first 2 lines of it this virus came from Manila, Philippines by somebody going by the nick spyder.
I know this is an incomplete description I do not know VBScript nor MIRC very well.