VBS:Tune

is a computer worm created in VBS (Visual Basic Script language).It arrives  via e-mail and is activated by double click on the message attachment. It requires Windows Scripting Host to be installed on the victim's computer. This support is not installed under Windows 95 and Windows NT 4 by default. It is installed under Windows 98 and Windows 2000 and it is also  part of some additional software packages (such as Microsoft Internet Explorer v5.x).

VBS:Tune was discovered in December 1999 and there are several variants known today. This worm uses Outlook as the primary spreading channel. It is also able to use mIRC or Pirch as secondary distribution channels.

VBS:Tune copies itself to three different folders: Windows, Windows\system and temporary directory. It also modifies two registry keys for its activation after computer restart:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\TaskMonitor

It also copies itself to the root of each local and network drive to increase its chance to spread further. 

VBS:Tune sends itself via Outlook application as an attachment in a similar way as Melissa does. It sends the infected message  to all recipients in every address book. The message has the following subject and body: 

Subject: Please Read
Body:    Hey, you really need to check out this attached file
         I sent you...please check it out as soon as possible.

The worm sends itself  only once from the infected computer.

VBS:Tune is also able to spread via mIRC and Pirch clients. When it finds them, it overwites the "script.ini" or "events.ini" files.