1. /
  2. Security Response/
  3. VBS.Bingd@mm

VBS.Bingd@mm

Risk Level 2: Low

Discovered:
July 29, 2003
Updated:
February 13, 2007 12:04:20 PM
Also Known As:
Trojan.VBS.NoExp [KAV], VBS/Generic@MM [McAfee]
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

VBS.Bingd@mm is a mass-mailing worm that spreads using Microsoft Outlook. It modifies the registry and sends itself to the first seven addresses in the Microsoft Outlook Address Book. It is written in Visual Basic Script.



The default settings for the keys that the worm changed are:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoRun,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoClose,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoDrives,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    System\DisableRegistryTools,0
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
    ScanRegistry,"scanregw.exe /autorun"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoLogOff,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    WinOldApp\NoRealMode,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoDesktop,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    WinOldApp\Disabled,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoSetTaskBar,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoViewContextMenu,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoSetFolders,0
  • HKEY_LOCAL_MACHINE\Software\CLASSES\.reg\,"regfile"
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\
    LegalNoticeCaption,""
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\
    LegalNoticeText,""
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Restrictions\NoBrowserContextMenu,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Restrictions\NoBrowserOptions,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Restrictions\NoBrowserSaveAs,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Restrictions\NoFileOpen,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\Advanced,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\Cache Internet,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\AutoConfig,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\HomePage,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\History,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\Connwiz Admin Lock,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\SecurityTab,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Control Panel\ResetWebSettings,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Restrictions\NoViewSource,0
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
    Infodelivery\Restrictions\NoAddingSubScriptions,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\NoFileMenu,0


Antivirus Protection Dates

  • Initial Rapid Release version July 30, 2003
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version July 30, 2003
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date July 30, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Difficult

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: High
Writeup By: Maryl Magee

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver