FRISK Software International


Summary of VBS/VBSWG.X@mm
Alias:Homepage
Discovered: 9 May 2001
Risk Level: Medium
Distribution:High
Infection Method:Infected e-mail attachments
 
Jump to:
Brief description
Technical description

Brief Description
This is an encrypted worm generated with VBSWG virus kit. It is similar to the widely spread worm at February 2001 - VBS/Onthefly (also known as Anna Kournikova worm).


Technical Description
VBSWG.X worm spreads using Outlook Application. It sends messages with the following content:

    Subject:    Homepage
    Body:       You've got to see this page! It's really cool ;O)
    Attachment: homepage.HTML.vbs
When the attached file is executed, the worm will send (mass mail) itself to each recipient in every address book. Then the worm tries to hide the mass mailing. It deletes all messages from Inbox and Deleted Items folders which contain a subject 'Homepage'. To mark that the mass mailing has been done, VBSWG.X adds a registry key:

               HKCU\software\An\mailed
After that, depending on a random number, the worm attempts to open one of four x-rated web pages. However, the mass-mailing part of the code generates much more serious consequences, including overloading e-mail servers and public relation problems.


[Analysis: Mikko Hypponen, Katrin Tocheva and Sami Rautiainen, F-Secure; May 2001]
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is