1. Symantec/
  2. Security Response/
  3. VBS.Saur.A


Risk Level 1: Very Low

February 13, 2007 11:33:56 AM
Also Known As:

This worm is written in Visual Basic Script and is spread via Microsoft Outlook. The worm mails itself to everyone in the Outlook address book. It arrives in email as a Batch file (bulbasaur.bat) and creates a VBS and HTML file for further propagation. The worm also attempts to spread itself by IRC via mIRC or Pirch, sending the HTML version of itself to other users via DCC.

Since the virus utilizes Visual Basic Script, you need Windows Scripting Host installed, which is the default under Windows 98 and Windows 2000. Windows Scripting Host is also installed with the latest version of Internet Explorer.

Antivirus Protection Dates

  • Initial Rapid Release version July 25, 2000
  • Latest Rapid Release version May 31, 2016 revision 036
  • Initial Daily Certified version July 25, 2000
  • Latest Daily Certified version June 1, 2016 revision 005
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Eric Chien

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube