VBSWG.X worm spreads using Outlook Application. It sends messages with the following content:
Subject: Homepage
Body: You've got to see this page! It's really cool ;O)
Attachment: homepage.HTML.vbs
When the attached file is executed, the worm will send (mass mail) itself to each recipient in every address book. Then the worm tries to hide the mass mailing. It deletes all messages from Inbox and Deleted Items folders which contain a subject 'Homepage'. To mark that the mass mailing has been done, VBSWG.X adds a registry key:
HKCU\software\An\mailed
After that, depending on a random number, the worm attempts to open one of four x-rated web pages. However, the mass-mailing part of the code generates much more serious consequences, including overloading e-mail servers and public relation problems.
|
