Kinda funny how a windows Outlook virus made its way to a LINUX mailing list,
where I'm sure majority of the people on here use LINUX. :-)
Terry Sheltra
On Wednesday 09 May 2001 09:41, you wrote:
> At 07:59 05/09/2001 -0400, Dorian_750 wrote:
> >Hi!
> >You've got to see this page! It's really cool ;O)
> >Attachment Converted:
> > "C:\applications\EudoraPro\Attach\homepage.HTML3.vbs"
>
> ===========================================
>
> Re: [newbie] Homepage [ALERT] Virus alert...
>
> VBSWG.X (also known as VBS.VBSWG.X and VBS.Homepage)
> <http://www.cai.com/virusinfo/encyclopedia/descriptions/vbsvbswgx.htm>
>
> VBSWG.X is a worm spreading via the Internet e-mail system and is yet
> another variant generated by the VBS Worm Generator Kit.
>
> The worm arrives as a message with the Subject line:
>
> "Homepage"
>
> and the message body:
>
> "Hi!
> You've got to see this page! It's really cool ;O)"
>
> The attached file, which contains the worm code is named:
>
> "HOMEPAGE.HTML.VBS"
>
> When the attached code is executed, VBSWG.X saves a copy of its code to the
> Temp directory and then mails itself out to all recipients listed in all
> address books.
>
> Once the mailing procedure is completed the worm modifies the registry
> entry (sets it to 1):
>
> HKEY_CURRENT_USER\Software\An\mailed
>
> Next, the worm browses through the Inbox and Deleted Outlook folders and
> deletes all messages with the same Subject line as the worm's one
> ("Homepage").
>
> Finally, VBSWG.X uses a default Web browser to open one of the following
> pages:
>
> "http://hardcore.pornbillboard.net/shannon/1.htm";
> "http://members.nbci.com/_XMCM/prinzje/1.htm";
> "http://www2.sexcropolis.com/amateur/sheila/1.htm";
> "http://sheila.issexy.tv/1.htm";
>
> |-=-=-=-=-=-=-=-=-=-=-<-30->-=-=-=-=-=-=-=-=-=-=-|
