Virus Characteristics

VBS/Pica.g is an Internet worm which can send itself via MAPI email and to IRC channels via a modified mIRC configuration file. Due to the suspicious attachment file name, this virus is not expected to spread far. This worm requires that Windows Scripting Host be installed in order to propagate. VBS/Pica.g sends itself via an e-mail similar to the following:

Subject = "Here you have, ;o)"
Body = "Test please do not open"
Attachment = "Sillyworm.vbs"

After the virus has sent itself to all recipients in the available address books, it will add the following tag to the system registry:

"HKCU\software\Sillyworm\mailed" = "1"

This worm also modifies the system registry to run from this key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SysBoot = Sillyworm.vbs