Home > Threat descriptions >

VBSWG.X@mm

Classification

Category: Malware

Type: Worm

Aliases: VBSWG.X@mm, Homepage

Summary


VBSWG.X, also known as Homepage, is an encrypted email worm found in the wild on May 9th, 2001

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details



Variant:VBSWG.X

This is an encrypted worm generated with VBSWG virus kit. It is similar to the widely spread worm at February 2001 - VBS/Onthefly (also known as Anna Kournikova worm).

VBSWG.X worm spreads using Outlook Application. It sends messages with the following content:

Subject:

Homepage

 Body: You've got to see this page! It's really cool ;O)

 Attachment: homepage.HTML.vbs
 

When the attached file is executed, the worm will send (mass mail) itself to each recipient in every address book. Then the worm tries to hide the mass mailing. It deletes all messages from Inbox and Deleted Items folders which contain a subject 'Homepage'. To mark that the mass mailing has been done, VBSWG.X adds a registry key:

HKCU\software\An\mailed
 

After that, depending on a random number, the worm attempts to open one of four x-rated web pages. However, the mass-mailing part of the code generates much more serious consequences, including overloading email servers and public relation problems.

Information about the original VBS/Onthefly.A (also known as I-Worm.Lee.o and VBS/VBSWG) is available at: https://www.F-Secure.com/v-descs/onthefly.shtml

F-Secure Anti-Virus detects this variant with the updates published at May 9th, 2001.