Detected by Sophos Anti-Virus since July 1999.
This virus is an encrypted VB Script virus that spreads itself by email, network drive sharing and IRC client scripting abilities. The virus spreads as an email message with subject "Check this". The message text is "Have fun with this cool links", and the message attachment is the actual virus.
If the attached VBS script (LINKS.VBS) is run, it displays a message "This will add a shortcut to free XXX links on your desktop. Do you want to continue ?".
If the answer is yes the virus creates a .URL file that contains a link to an adult website.
The virus makes changes to the Windows registry key \HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN\Rundll so that C:\WINDOWS\SYSTEM\RUNDLL.VBS is run every time the infected computer is rebooted. The RUNDLL.VBS file checks if there are mIRC or PIRCH IRC clients installed and if any of these are, the virus creates a SCRIPT.INI or EVENTS.INI file which sends the virus to other users on the same IRC channel on a JOIN channel event.
If there is a shared network disk drive, the virus will copy itself to the drive and therefore spread through a network. The virus attempts to create and send the above email message to all entries in the user's Outlook address book.
Please read the instructions for removing worms.
Check other computers on your network to ensure that the worm has not spread.
After deleting the worm files in Windows NT/2000 you will need to delete the following registry key. The removal of this key is optional in Windows 95/98/Me.
At the Windows taskbar, select Start|Run. Type 'Regedit' and press return. The registry editor will open.
Before you edit the registry, you should make a backup. In the Registry menu, click on Export Registry File, in Export Range select All, then save your registry as Backup.