1. Symantec/
  2. Security Response/
  3. VBS.Gaggle.B@mm


Risk Level 1: Very Low

December 18, 2002
February 13, 2007 11:54:26 AM
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

  • Is a mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Outlook Address Book
  • Also attempts to spread through mIRC.
  • Appends itself to all the .asp, .hta, .htm, .html, .msconfig, .php, .phtm, .phtml, .plg, .regedb32, .sfc, .shtm, and .shtml files in all the folders of all the drives, except in the root folders.
  • Overwrites all the .vbs files in all the folders of all the drives with itself, except for the .vbs files in the root folders.
  • Deletes the files Msconfig.exe and Regedit.exe.

The email can have various subjects, messages, and attachments.

Antivirus Protection Dates

  • Initial Rapid Release version December 19, 2002
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version December 19, 2002
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date December 24, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Yana Liu

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube