VBS/LegaliseIt.A is an email worm for Microsoft Outlook written in Visual Basic Script.  It arrives on the computer as a file in an email message attachment.  When the file in the attachment is executed the worm is activated.
By means of the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner the worm reads from the system registry name to which the operating system is registered.  If the name is for example "Rotter Rudi" it will create a file in the disk C:\ root directory and copy itself to it.  The name of the created file will be Rotter Rudi.GIF.vbs or Rotter Rudi.JPG.vbs depending on the random numbers generator.
Then the worm will send a message with subject "my pic" to the first 50 addresses from the Microsoft Outlook address book.  Into the message body it will insert the following text:

Here is my pic ...
c ya soon in the chat - Rotter Rudi (this name is changed)

LEGALIZE IT!

The attachment of the message created in this way will always be the worm copy while the attachment name will be the same as the name of the file created by the worm on the disk.  All these messages will be deleted after being sent.  The only additional presentation of the worm will be the following displayed window:

It will be displayed if the worm is activated at the moment when number of seconds in the system timer equals the number of minutes, or if the sequence number of the day in a month equals the number of hours on the system timer.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.