VBS_SLUDGE.A -- via Kazaa Lite

GoneShootin

Sludge in your Computer - VBS_SLUDGE.A (Low Risk)
VBS_SLUDGE.A is a Visual Basic script worm that spreads using the peer-to-peer file sharing application Kazaa Lite.

Upon execution, this worm drops a copy of itself in the Windows temporary folder using the file name "_uninst12.vbs." It then adds a registry entry so that its dropped copy is executed at every Windows startup.

This virus creates copies of itself using one of 12 specific file names. These copies are dropped in %Program Files%\kazaa lite\my shared folder, a common shared folder of Kazaa Lite.

This worm is intended to also propagate through Kazaa, Bearshare, Edonkey2000 and Morpheus, but fails to do so due to flaws in its script code. Although the script checks for the existence of the shared folders of these peer-to-peer, file-sharing applications, it incorrectly copies the dropped files to Kazaa Lite's shared folder. The folders checked are:

%Program Files%\bearshare\shared
%Program Files%\edonkey2000\incoming
%Program Files%\kazaa\my shared folder
%Program Files%\morpheus\my shared folder

When the infected user's system date is March 3, this worm displays a message box with the following text:

Address violation at 030303x
03/03/03 exception error. Please reboot.