The VBS.VBSWG2.D@mm worm, also known as the VBS_Homepage.A virus, appears to be spreading rapidly throughout SA.
A variant of the Anna Kournikova worm, the virus uses the typical e-mail attachment method to spread itself throughout the Internet.
When a user executes the attachment - a Visual Basic Script file called Homepage.HTML.vbs - the virus randomly selects one of four pornographic Web pages and displays them while it deletes any e-mail messages with the subject "Homepage". It then mails itself to the contacts in the user's address book.
The attachment contains an encrypted payload, which ITWeb has decrypted. The source code can be seen here.
The subject for the virus is "Homepage", and the contents will read: "Hi! You've got to see this page! It's really cool ;O)".
SecureData reports "millions" of infections locally, and ITWeb received the virus from multiple sources today.
Symantec has ramped up its distribution meter to "high" for the virus, which was only discovered yesterday.
"We don't see it as a major threat at this point," comments Jako Voges, marketing manager, Symantec South Africa. "That might change," he adds.
Share
