1. /
  2. Security Response/
  3. VBS.Saur.A

VBS.Saur.A

Risk Level 1: Very Low

Updated:
February 13, 2007 11:33:56 AM
Also Known As:
Bulbasaur
Type:
Worm

This worm is written in Visual Basic Script and is spread via Microsoft Outlook. The worm mails itself to everyone in the Outlook address book. It arrives in email as a Batch file (bulbasaur.bat) and creates a VBS and HTML file for further propagation. The worm also attempts to spread itself by IRC via mIRC or Pirch, sending the HTML version of itself to other users via DCC.

Since the virus utilizes Visual Basic Script, you need Windows Scripting Host installed, which is the default under Windows 98 and Windows 2000. Windows Scripting Host is also installed with the latest version of Internet Explorer.

Antivirus Protection Dates

  • Initial Rapid Release version July 25, 2000
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version July 25, 2000
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Low

Distribution

  • Distribution Level: Low
Writeup By: Eric Chien

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver