| Name: | Little Davinia |
| Aliases: | VBS/Davinia-A, JS/Davinia-A, Davinia, WM97/Davinia-A, HTML/LittleDavinia, VBS/Davinia@MM, W2KM.Davinia.A, |
| Ports: | |
| Files: | Littledavinia.vbs - Littledavinia.html - |
| Created: | Jan 2001 |
| Requires: | |
| Actions: | Worm / Network trojan / Destructive trojan / Mail trojan / Macrotrojan |
| The mail have no subject and is HTML encoded, but shows no visible text. The user is infected just by opening it and the code opens Internet Explorer and gets it to download and open a Word 2000 document. Davinia propagates to all addresses in Outlook and to all shared drives and directories. It will then overwrite all files in subdirectories. Users infected by mail receives two scripts - one that alters Internet Explorer´s start page and direct the browser to the coder´s site, and an other that opens an infected Word document on the site. This site is now closed. | |
| Versions: | |
| Registers: | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ |
| Notes: | Works on Windows, together with MS Word 2000, MS Outlook and MSInternet Explorer. |
| Country: | written in Spain |
| Program: | Written in Visual Basic Script (VBS). |