Anti-virus software and services vendor Trend Micro is reporting the appearance of VBS_CIAN.C, a Visual Basic Script virus that arrives as a .DOC or .XLS attachment on email.

The virus infects VBScript, .DOC, and .XLS files. It also drops multiple copies of itself in the Windows and Windows System directories. In order to spread, this VBS worm sends an email to all addresses listed in the Windows Address Book (WAB) of its infected system. Here are the details of the email:

Subject: (Editor's note: Could be any of the following)
Here is that file
Important file
The file
Excel file
The file you wanted
Here is the file

Message Body: The file I am sending you is confidential as well as important; so don't let anyone else have a copy.

Attachment:

This worm also spreads via peer-to-peer applications such as Grokster, ICQ, Edonkey2000, and Bearshare. To do so, it overwrites files with certain extensions in the shared folders of these applications and then appends a .VBS extension to the original file names. Find out what the extensions are here.