VBS/VBSWG.X Worm

 Information about the VBS/VBSWG.X worm:

VBSWG.X is an encrypted email worm. VBS/VBSWG.X will infect Windows 98 and Windows 2000 systems. Windows 95 and Windows NT users also can be affected if the Visual Basic scripting is enabled. This worm spreads through MS Outlook.

The worm comes through an email attachment with the message having the title:

Homepage

and the body of the mail will be:

Hi!

You've got to see this page! It's really cool ;O)

The infected mail carries an attachment called Homepage.HTML.vbs. Executing the attachment it copies itself to WINDOWS\SYSTEM directory as Homepage.HTML.vbs. Later on worm checks the following registry key to ensure if email has already been sent out to all addresses in the MS Outlook address book:

HKEY_CURRENT_USER\Software\An\Mailed

If the value of the entry is not equal to 1 then the worm mails itself as an attachment to all addresses found under MS Outlook address book. After this it creates the above registry key entry with a value 1.

It also tries to open some pornographic Web sites through the browser.

VBS/VBSWG.X worm first appeared in May 2001.

 Other names of VBS/VBSWG.X worm:

This worm is also known as VBS/Homepage, VBS.VBSWG2.

 Removing VBS/VBSWG.X worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.