Homepage
Originally Spotted 09/05/01

E-Mail Message Received (please note different mails may differ slightly)

Subject: Homepage

Body: Hi!

You've got to see this page! It's really cool ;O)

Attachment: HOMEPAGE.HTML.VBS

Diagnosis

VBS/VBSWG-X or Homepage is an email aware worm based around the VBSWG virus writing kit. It uses Outlook to email itself to each entry in your Outlook address book.

When the worm is executed it saves itself to the file homepage.HTML.vbs in the system temporary directory.

The first time it is run the worm sends itself to everyone in your address book and then sets the registry entry "HCKU\software\An\mailed" to 1 to prevent the email code being run multiple times.

The worm then randomly chooses one of four possible adult-orientated website addresses, and displays it using the default web browser.