VBS.Xxx is a script Trojan that looks for the presence of the following folders:
- C:\Mirc
- C:\Mirc32
- C:\Programs\Mirc
- C:\Programs Files\Mirc
- C:\Programs Files\Mirc32
If it finds one of these folders, it searches that folder's \Download subfolder for the file xxxpasswords.html and copies that file to C:\Aadride.exe. If it does not find any of these folders, it copies the Autoexec.bat file to the file C:\Adride.exe.
Finally, the Trojan runs C\Adride.exe.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
