Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Homepage.A

Aliases: VBS/VBSWG.x

VBS/Homepage.A is a worm that spreads in email messages with subject: "Homepage".  There is the following text in the message body:

Hi!

You've got to see this page! It's really cool ;O)

In the file attachment named Homepage.html.vbs is a simply encrypted worm body.  When it is run it decodes itself, writes the attachment into temporary directory and sends out identical emails messages to addresses in the MS Outlook address book.  It marks finished actions into the registry by creating the key in HKCU\software\An\mailed with the value of 1.  When it is run again the worm does not send out the email messages.  In addition it deletes all e-ail messages with subject "Homepage" in folders Inbox and Deleted Items; by doing so it tries to sweep its tracks.  Finally, it randomly chooses and displays one of the pages:

http://hardcore.pornbillboard.net/shannon/1.htm
http://members.nbci.com/_XMCM/prinzje/1.htm
http://www2.sexcropolis.com/amateur/sheila/1.htm
http://sheila.issexy.tv/1.htm

Heuristic analysis of the system NOD32 is able to intercept this virus from version 1.70.  You can remove the worm manually simply by deleting the e-ail message and its file located in the temporary windows directory, and by removing the above mentioned key from the system registry.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.