VBS.FreeLink

This is a worm written in Visual Basic Script language (VBS). This worm spreads via e-mail and IRC (Internet Relay Chat) channels. 
Being executed the worm script creates new script file "RUNDLL.VBS" in the Windows system folder and modifies system registry to 
execute this script every Windows startup. 

Then the worm displays message box: 

  This will add a shortcut to free XXX links on your desktop. Do you want
  to continue?

If user answer is YES the worm creates shortcut on the desktop with URL to XXX site. 
Then the worm enumerates all network drives on computer and copies infected script to the 
root directory of each network drive. 

To spread via e-mail the worm uses the MS Outlook. The worm spreading routine is very closed
to such routine in the "Melissa" virus, and works in the same way. The message with infected worm script contains 
attached worm script (LINKS.VBS). 

 The message subject: Check this
 The message body:    Have fun with these links.

The "RUNDLL.VBS" script when run creates another script file "LINKS.VBS" in Windows directory (LINKS.VBS is the same script as described above). 
Then it scans all fixed drives for folders "MIRC", "PIRCH98", "Program Files" (folder where usually installed most of Windows programs) and also
all their subfolders and searches for the "MIRC32.EXE" or "PIRCH98.EXE" programs (popular IRC clients). If any of such programs is found, the 
worm creates a script file (SCRIPT.INI for MIRC or EVENTS.INI for PIRCH) that contains commands to send infected "LINKS.VBS" to other IRC users 
when they join the same IRC channel to which infected computer is connected. 

    Source: geocities.com/timessquare/alley/2794

               ( geocities.com/timessquare/alley)                   ( geocities.com/timessquare)