Threat Descriptions

VBSWG.X@mm

Classification

Category :

Malware

Type :

Worm

Platform :

VBS

Aliases :

VBSWG.X@mm, Homepage

Summary

VBSWG.X, also known as Homepage, is an encrypted email worm found in the wild on May 9th, 2001

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Variant:VBSWG.X

This is an encrypted worm generated with VBSWG virus kit. It is similar to the widely spread worm at February 2001 - VBS/Onthefly (also known as Anna Kournikova worm).

VBSWG.X worm spreads using Outlook Application. It sends messages with the following content: 

Subject:

Homepage

 Body: You've got to see this page! It's really cool ;O)

 Attachment: homepage.HTML.vbs

When the attached file is executed, the worm will send (mass mail) itself to each recipient in every address book. Then the worm tries to hide the mass mailing. It deletes all messages from Inbox and Deleted Items folders which contain a subject 'Homepage'. To mark that the mass mailing has been done, VBSWG.X adds a registry key: 

HKCU\software\An\mailed

After that, depending on a random number, the worm attempts to open one of four x-rated web pages. However, the mass-mailing part of the code generates much more serious consequences, including overloading email servers and public relation problems.

Information about the original VBS/Onthefly.A (also known as I-Worm.Lee.o and VBS/VBSWG) is available at: https://www.F-Secure.com/v-descs/onthefly.shtml

F-Secure Anti-Virus detects this variant with the updates published at May 9th, 2001.