1. /
  2. Security Response/
  3. VBS.Angel@mm

VBS.Angel@mm

Risk Level 2: Low

Discovered:
March 23, 2001
Updated:
February 13, 2007 11:59:04 AM

VBS.Angel@mm is a worm written in the Visual Basic scripting language. However, this worm also includes a 1122-byte variant of W95.CIH. When the worm is executed, it emails everyone in the Microsoft Outlook address book. It also creates and executes a file containing the virus W95.CIH. This variant of W95.CIH contains the payload that will damage the CMOS.

NOTE: Definitions prior to the March 23, 2001, detect the worm as VBS.Rewind.A@mm, and the W95.CIH variant is detected as Bloodhound.W32.EP.


There are several comments inside the worm that points to show that the country of origin for the worm is Brazil.

Precautions that you can take
VBS.Angel@mm, like many other worms, is written in the Visual Basic Scripting language.
  • If you are using Norton AntiVirus 2001, a free program update is available that includes Script Blocking is available.Please run LiveUpdate to obtain this.
  • For other versions of Norton AntiVirus, SARC offers a tool to disable the Windows Scripting Host.

Antivirus Protection Dates

  • Initial Rapid Release version March 23, 2001
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version March 23, 2001
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Low

Distribution

  • Distribution Level: Medium
Writeup By: Neal Hindocha

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver