14 DAY TRIAL // WORM_VB.ZAA is a new kind of worm that attempts to infect the Windows computers, being executed once the user starts Windows Media Player. Security company Trend Micro wrote that the worm affected most versions of the operating system powered by Microsoft, including Windows 98, ME, NT, 2000, XP and Server 2003. But, what's more important is that it has a high distribution potential bundled with a medium damage potential, so extra-caution is recommended, if you want to keep your computer protected. Now, let's see more details about the infection.
Just like many other 2007 worms, WORM_VB.ZAA attempts to spread itself by copying its files on every clean removable drive connected to an infected computer. When the device is plugged into a clean system, the infection is automatically executed and copies its files on the computer. Classic, I would say. Obviously, it also drops an Autorun.Inf file to be sure it is executed every time a new drive is connected to the PC.
Trend Micro informed that WORM_VB.ZAA can be easily downloaded by visiting malicious websites equipped with the worm. In addition, it can also be deployed by another malware that has already been installed on the system.
And now, the juicy part: the worm is executed once the user starts Windows Media Player and displays the following message: "Please Install QuickTime Player to play this file!"
"This worm modifies a certain registry entry to hide file extension names. It also hides files with System attributes by modifying another registry entry", Trend Micro wrote.
So, next time you're advised to switch to another media player (such as Apple's QuickTime) and abandon the famous application that comes with the Windows operating system, you should start a full system scan, because you may be infected with WORM_VB.ZAA...