One sign of this virus - you may receive an attachment that looks like a folder icon.
From this report, it sounds pretty much like the thumbdrive virus that has been spreading previously. What's a folder no longer is a folder, but an executable file.
Good luck again to porn lovers.
______________________________________________________________
From Microworld:
Security Experts at MicroWorld Technologies advise computer users to be wary of an email that comes as a zipped file, promising Japanese and Indonesian pornography. The attachment carries a Worm named ‘Win32.VB.co’, which infects computers and starts a mass mailing campaign to email addresses found in the victim’s address book.
‘Japanese Porn’, ‘Miss Indonesian’ and ‘Hello’ are some of the subject lines of the emails sent out from the infected computer, with message contents like ‘F****g with me
’, ‘Please read again what I have written to you’, ‘hey Indonesian porn, Agnes Monica's porn’ and more.
The names of the attachments may be ‘Doc 8328328.zip’, ‘file 2151981.zip’ and ‘Miyabi 5315261.zip’, just as these numbers are generated randomly. The recipients of the mail get infected once they download and run the attachment.
“This email Worm has got some note-worthy features. While sending mails to the entities found in the address book it spoofs the sender’s ID as the victim’s ID. Once you extract the file it shows a folder icon, though in fact it is an exe file. The unsuspecting user will try to open the imposter ‘folder’ and will run the exe in the bargain,” says Vikas Vishwasrao, a Senior Security Analyst at MicroWorld Technologies.
What follows is even more interesting! Win32.VB.co proceeds to create an exe file inside every folder in the computer, with the name of the file being the same as that of the folder. Here too, the file shows up with a folder icon. The worm then tries to spread by copying itself into popular file sharing applications. It can log keystrokes and send that to a remote attacker in order to facilitate Identity Theft. It also attempts to turn off AntiVirus applications.
Other than the email route, Win32.VB.co can also spread via shared folders and P2P applications. This will enable this Worm to spread in a large network within a span of few hours forcing shut down of networks in some cases.
