Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


VBSWG.X@mm


Aliases:


VBSWG.X@mm
Homepage

Malware
Worm
VBS

Summary

VBSWG.X, also known as Homepage, is an encrypted e-mail worm found in the wild on May 9th, 2001



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


Variant:VBSWG.X

This is an encrypted worm generated with VBSWG virus kit. It is similar to the widely spread worm at February 2001 - VBS/Onthefly (also known as Anna Kournikova worm).

VBSWG.X worm spreads using Outlook Application. It sends messages with the following content:

  Subject:    Homepage
    Body:       You've got to see this page! It's really cool ;O)
    Attachment: homepage.HTML.vbs


When the attached file is executed, the worm will send (mass mail) itself to each recipient in every address book. Then the worm tries to hide the mass mailing. It deletes all messages from Inbox and Deleted Items folders which contain a subject 'Homepage'. To mark that the mass mailing has been done, VBSWG.X adds a registry key:

  HKCU\software\An\mailed


After that, depending on a random number, the worm attempts to open one of four x-rated web pages. However, the mass-mailing part of the code generates much more serious consequences, including overloading e-mail servers and public relation problems.

Information about the original VBS/Onthefly.A (also known as I-Worm.Lee.o and VBS/VBSWG) is available at: http://www.F-Secure.com/v-descs/onthefly.shtml

F-Secure Anti-Virus detects this variant with the updates published at May 9th, 2001.





Description Created: Analysis: Mikko Hypponen, Katrin Tocheva and Sami Rautiainen, F-Secure; May 2001



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free