VBS.FreeLink

This is a worm written in Visual Basic Script language (VBS). This worm spreads via e-mail and IRC (Internet Relay Chat) channels.

Being executed the worm script creates new script file "RUNDLL.VBS" in the Windows system folder and modifies system registry to

execute this script every Windows startup.

Then the worm displays message box:

This will add a shortcut to free XXX links on your desktop. Do you want

to continue?

If user answer is YES the worm creates shortcut on the desktop with URL to XXX site.

Then the worm enumerates all network drives on computer and copies infected script to the

root directory of each network drive.

To spread via e-mail the worm uses the MS Outlook. The worm spreading routine is very closed

to such routine in the "Melissa" virus, and works in the same way. The message with infected worm script contains

attached worm script (LINKS.VBS).

The message subject: Check this

The message body: Have fun with these links.

The "RUNDLL.VBS" script when run creates another script file "LINKS.VBS" in Windows directory (LINKS.VBS is the same script as described above).

Then it scans all fixed drives for folders "MIRC", "PIRCH98", "Program Files" (folder where usually installed most of Windows programs) and also

all their subfolders and searches for the "MIRC32.EXE" or "PIRCH98.EXE" programs (popular IRC clients). If any of such programs is found, the

worm creates a script file (SCRIPT.INI for MIRC or EVENTS.INI for PIRCH) that contains commands to send infected "LINKS.VBS" to other IRC users

when they join the same IRC channel to which infected computer is connected.