VBS.Bingd@mm

VBS.Bingd@mm is a mass-mailing worm that spreads using Microsoft Outlook. It modifies the registry and sends itself to the first seven addresses in the Microsoft Outlook Address Book. It is written in Visual Basic Script.



The default settings for the keys that the worm changed are:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoRun,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoClose,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoDrives,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  System\DisableRegistryTools,0
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
  ScanRegistry,"scanregw.exe /autorun"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoLogOff,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  WinOldApp\NoRealMode,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoDesktop,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  WinOldApp\Disabled,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoSetTaskBar,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoViewContextMenu,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoSetFolders,0
• HKEY_LOCAL_MACHINE\Software\CLASSES\.reg\,"regfile"
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\
  LegalNoticeCaption,""
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\
  LegalNoticeText,""
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Restrictions\NoBrowserContextMenu,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Restrictions\NoBrowserOptions,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Restrictions\NoBrowserSaveAs,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Restrictions\NoFileOpen,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\Advanced,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\Cache Internet,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\AutoConfig,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\HomePage,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\History,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\Connwiz Admin Lock,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\SecurityTab,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Control Panel\ResetWebSettings,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Restrictions\NoViewSource,0
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
  Infodelivery\Restrictions\NoAddingSubScriptions,0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
  Explorer\NoFileMenu,0

Protection

• Initial Rapid Release version July 30, 2003
• Latest Rapid Release version July 12, 2008 revision 018
• Initial Daily Certified version July 30, 2003
• Latest Daily Certified version July 12, 2008 revision 019
• Initial Weekly Certified release date July 30, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Difficult

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High