VBS.VBSWG.AF is a Visual Basic Script (VBS) threat that can overwrite .vbe or .vbs files with a copy of itself. It attempts to send itself using MAPI email, but the attempt fails due to bugs in the script.
In an attempt to distribute itself using Internet Relay Chat (IRC), it may also modify existing Script.ini files, which are used by the mIRC program.
Additional precautions that you can take
Some threats, such as this one, use the VBScript computer language to run. You can protect yourself from threats that use this language by enabling Script Blocking (Norton AntiVirus 2001/2002) or by disabling or uninstalling the Windows Scripting Host. Because the Windows Scripting Host is an optional part of Windows, it can be safely removed from your computer. (Some programs, however, need Windows Scripting Host in order to function properly.)
- If you are using Norton AntiVirus 2002, which includes Script Blocking, make sure that Script Blocking is enabled (the default).
- If you are using Norton AntiVirus 2001, a free program update that includes Script Blocking is available. Please run LiveUpdate to obtain this.
- For other versions of Norton AntiVirus, SARC offers a tool to disable the Windows Scripting Host.
- To disable the Windows Scripting Host in Microsoft Outlook Express only, see the Microsoft Knowledge Base document OLEXP: How to Disable Active Scripting in Outlook Express, Article ID: Q192846.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.