From: "List Manager" To: Subject: AVX News for 05/09/2001 Date: Wednesday, May 09, 2001 10:05 PM AVX.COM Newsletter Central Command - Without us, there's no defense. You are receiving this newsletter because you subscribed to the AVX.COM newsletter at http://www.avx.com. This is an open-subscription mailing list. If you do not want to receive this newsletter please see the bottom of this message for instructions on how to remove your e-mail address from this mailing list. Virus Protection for the Real World. If you suspect a virus infection you can download a free time limted, fully functional trial version of AVX Professional antivirus software from http://www.avx.com Visit AVX.COM online http://www.avx.com Due to the increase in confirmed infectious reports ITW of VBS.Homepage.A@mm, Central Command has issued this alert and virus description. Our Emergency Virus Response Team has already added detection for this mass mailer through AVX Live! Details: --------------- Name: VBS.Homepage.A@mm Aliases: VBS/VBSWG-X, VBS.Homepage, VBS.VBSWG2.D@mm Type: E-mail worm written in Visual Basic Script Size: 2K (2438 bytes) Risk: High In the wild: Yes Description: ------------------ VBS.Homepage.A@mm is yet another common mass mailer generated using VBSWG (a program that generates VBS viruses, another noticeable “product” of this program is VBS.SST family). When executed, the virus will copy itself in the Windows temporary folder (usually C:\Windows\Temp) in a file named “%TEMP%\ homepage.HTML.vbs”, then it sends itself to all the contacts in the Outlook Address Book. An infected e-mail has the following format: From: Subject: Homepage Attachment: homepage.HTML.vbs Message: Hi! You've got to see this page! It's really cool ;O) The virus will also creates the registry key “HKCU\software\An\mailed” and sets its value to 1 so it won’t send infected e-mails again. Then, it will search the “Inbox” and and “Deleted Items” folders in Oulook and delete all the e-mails with the subject “Homepage”. Finally, it randomly selects one of the four adult-content websites in its body (not listed here) and starts it in the default internet browser. Detection has been added for this virus. Central Command, Inc. respects your online privacy. You at anytime can easily remove your e-mail address from the AVX-News mailing list by sending an e-mail message To: avx-news-request@avx-listserver.com and in the body of the message include the following replacing "e-mail@domain.com" with your e-mail address. unsubscribe avx-news e-mail@domain.com You will receive a confirmation message about your successful removal from AVX-News. IF YOU ARE NOT ABLE TO REMOVE YOUR E-MAIL ADDRESS USING THE ABOVE METHOD PLEASE SEND AN E-MAIL MESSAGE TO REMOVE@AVX.COM AND REQUEST TO BE REMOVED MANUALLY. Central Command, PerfectSupport, EVRT, Emergency Virus Response Team, Virus Protection for the Real World, Without us, there's no defense. are trademarks of Central Command Inc. AVX and AntiVirus eXpert are trademarks of Softwin SRL, Romania. All other trademarks, trade name and product names are property of their respective owners. Copyright (C) 2000 Central Command Inc. All rights reserved.