VBSWG.X, also known as Homepage, is an encrypted e-mail worm found in
the wild on May 9th, 2001
This is an encrypted worm generated with VBSWG virus kit. It is
similar to the widely spread worm at February 2001 - VBS/Onthefly
(also known as Anna Kournikova worm).
VBSWG.X worm spreads using Outlook Application. It sends messages
with the following content:
Subject: Homepage
Body: You've got to see this page! It's really cool ;O)
Attachment: homepage.HTML.vbs
When the attached file is executed, the worm will send (mass mail)
itself to each recipient in every address book. Then the worm
tries to hide the mass mailing. It deletes all messages from
Inbox and Deleted Items folders which contain a subject
'Homepage'. To mark that the mass mailing has been done, VBSWG.X
adds a registry key:
HKCU\software\An\mailed
After that, depending on a random number, the worm attempts to
open one of four x-rated web pages. However, the mass-mailing
part of the code generates much more serious consequences,
including overloading e-mail servers and public relation
problems.
Information about the original VBS/Onthefly.A (also known as
I-Worm.Lee.o and VBS/VBSWG) is available at:
http://www.F-Secure.com/v-descs/onthefly.shtml
F-Secure Anti-Virus detects this variant with the updates published at
May 9th, 2001.
[Analysis: Mikko Hypponen, Katrin Tocheva and Sami Rautiainen, F-Secure; May 2001]
