Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Funny

VBS/Funny is a script worm written in the language VBS.  The worm uses Microsoft Outlook to spread its copies by email.  It exists in three variants slightly differing from each other.  The variant VBS/Funny.A is spread as an email message with subject "Funny story" and attachment FUNNY_STORY.HTM.vbs.  The subject of VBS/Funny.B is changed to "When did you die?" and as an attachment it contains the file LIFE_ASSURANCE.HTM.vbs. VBS/Funny.C was created by modification in a German speaking country – the subject of the message is changed to "Rechnungsabschrift" and the attachment is in this case RECHNUNGSABSCHRIFT.DOC.vbs.  VBS/Funny.A and VBS/Funny.B change, by means of manipulating the system registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HTTP\shell\open\command\ setting of the initial page for the Internet Outlook to http://www.makeyoulaugh.com/.  VBS/Funny.C opens the following text in the program write:

INVOICE

Date: September 18, 2000

From: Katrin Heinze
19, chemin des Aulx
CH-1228
Plan-les-Ouates,
Geneva
Switzerland

To: Myron Schmidt
Ch. des Boveresses
151
CH-1066 Epalinges
s/Lausanne
Switzerland

Item Description Cost

1 August Voice Mail Charges CHF 35.00
1 Internet - Reserve Domain Name (2 years)CHF 250.00
1 Internet - Set Up Fee CHF 110.00
1 Internet - Creation Fee CHF 250.00
1 Internet - Submit to 540 Search Engines CHF 50.00
1 Internet 6 Months of Hosting CHF 200.00

Total CHF 895.00
Terms - ASAP
Please remit to the above address.

All by now known variants of this worm contain a Trojan program PSW.Hooker.24.e.  They write its debug script on the disk, compile it by means of the debug program and finally ensure its activation.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.