W32.Desperate@mm

W32.Desperate@mm is a worm that spreads by creating multiple files. It creates a Windows executable, an mIRC script, and a Visual Basic Script (VBS) file. The worm then uses these files to spread its infection using IRC and Microsoft Outlook. The original dropper file for this worm is packed and encrypted. This appears to be an attempt to avoid detection and make it more difficult to analyze the worm. However, both the packer and the encryptor are well known and are, therefore, easily bypassed.

Because the original dropper for this worm is written in Visual Basic, it requires Visual Basic runtime libraries to execute.

NOTE: Virus definitions dated prior to April 11, 2001, will detect some components of this worm (such as the VBS file) as Bloodhound.VBS.Worm.