Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

VBSWG.J

Aliases: VBS.OnTheFly, Onthefly

VBSWG.J worm is written in Visual Basic Script (VBS) and is spread by email with subject:

Here you have, ;o).

In the email body there is the text:

Hi:
Check this!

In the attachment is the file AnnaKournikova.jpg.vbs in which the virus body is contained.  Kournikova is a well known Russian tennis player and the first file extension is a fake.  The worm body starts with the string Vbs.OnTheFly Created By OnTheFly and ends with the string Vbswg 1.50b.
The worm will write the value Worm made with Vbswg 1.50b  to the registry key HKEY_CURRENT_USER\SOFTWARE\ONTHEFLY\.  It uses the item HKEY_CURRENT_USER\SOFTWARE\ONTHEFLY\MAILED to mark the implemented send out of its body.  If there is not the value 1 in it, it will create the aforementioned email and send it to all addresses in the address book.
On January 26th it opens a web browser with the address of a computer shop chain in Holland www.dynabyte.nl.  Apart from this advertising the worm does no destructive activity.  This worm is also known under the name VBS.OnTheFly.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.