F-Secure Corporation Warns on Mawanella E-Mail Worm

Helsinki, Finland - May 17, 2001

F-Secure Corporation (HEX:FSC) is alerting computer users worldwide about a new, rapidly spreading e-mail worm called Mawanella. This worm is also known as VBSWG.Z.

The worm was found in the wild in USA just after midnight GMT on Thursday, May 17th. After that the worm has been spreading globally. In addition of USA, infections have been reported in Asia, Australia and Europe but especially in Northern Europe and Scandinavian area.

Mawanella is a worm generated with VBSWG virus toolkit. It is similar to two other well-known e-mail worms, Anna Kournikova and Homepage. These two worms were widespread in February 2001 and early May 2001, respectively.

The worm spreads using Outlook e-mail application. Mawanella sends messages with a subject "Mawanella" and a body "Mawanella is one of the Sri Lanka's Muslim village" and attachment called Mawanella.vbs.

When the attached file is executed, the worm will send (mass mail) itself to each recipient in every address book. After this, the worm displays a simple picture of a house and a political message:

Mawanella is one of the Sri Lanka's Muslim Village. This brutal incident happened here 2 Muslim Mosques & 100 Shops are burnt. I hat this incident, What about you? I can destroy your computer I didn't do that because I am a peace-loving citizen.

Otherwise, the virus doesn't do any direct damage.

"There has been relatively few widespread viruses which try to send out a political message", comments Mikko Hypponen. "It was simple to see why people wanted to click on Anna Kournikova. It's a little bit more difficult for me to understand why people want to click on something called Mawanella.vbs..."

F-Secure anti-virus required no separate update to handle this virus. Using advanced generic detection, this virus was detected by F-Secure Anti-Virus even before it was written, without any need for customers to update.

Technical description and screenshots of the VBSWG.Z worm as well as the VBSWG toolkit are available online at: http://www.f-secure.com/v-descs/vbswg_z.shtml