Extra Newsguy - Welcome!
Newsguy - Usenet Search, All Newsgroups, Members, My Account, Check Email


"Homepage Worm Finally Slowing"
  05/15/2001

A virus known as the Homepage worm has been spreading around the Internet for about a week, but it now appears that the widespread contamination may finally be slowing. Although
leading anti-virus companies such as McAfee and Symantec have released updates to their
respective software packages, the virus has not been contained as much as many had first
hoped.

According to the Symantec web site (www.symantec.com), the Homepage worm is being given a classification of 4. The classification, which is based on a possible of a worst case scenario of 5, has been given the classification mainly because of the widespread contamination worldwide. Other anti-virus software companies, who have different classifications, also have rated the virus as widespread. However, because the virus can be handled with freely available updates to most popular anti-virus software, the virus hasn't caused as much damage as was initially expected.

The Homepage worm, a Visual Basic Script (VBS), does not cause any damage to the system
that it is executed on. Instead, it copies itself to any messages that are sent using Microsoft Outlook and attempts to hide itself by deleting itself from the Inbox and Deleted Items folder. The worm opens several browsers when it is executed. The web sites were previously adult porn related. It has been theorized that the virus may have been written in an effort to gain web page hits for one or all of them.

The worm has not been as big of a problem in the US as it has been in other countries. Perhaps one reason for this is the firewalls that are set to block any email that has an EXE or VBS attachment. VBS attachments are becoming increasingly popular for virus writers mainly because it is an easy language to learn and also takes advantage of weaknesses in the Windows OS. Additionally, a VBS virus construction kit has been available online for quite some time. It allows individuals without programming experience to create viruses. In fact, the Anna Kournikova virus, which gained national attention several months ago, may have been created using this software.

As was previously mentioned, when the virus is executed, it opens several web browsers that are linked to adult web sites. These sites, under increasing pressure, have opted to disable the links that were opening. Now, instead of four adult porn sites, the virus opened web browsers all receive file not found errors.

If you regularly receive email attachments, you should follow the standard advice to open only attachments that are received from individuals you know and trust. Unfortunately, worms such as Homepage cause problems because users that are infected are emailing the virus to everyone in their address book without realizing it. Therefore, you may receive the email from someone you know, but it may still be a virus. You should make sure that you do not open any EXE or VBS files unless you are certain of their content. To further complicate the situation, virus writers are attempting to confuse you with names like Picture.jpg.vbs which can mistakenly appear to be a JPG picture. Lastly, make sure to consistently upgrade your anti-virus software so that you are protected against the newest viruses.

  - by Clayton Crooks

  Feature Writer Links:

  Related Newsgroups:
 
  alt.comp.virus
  comp.os.ms-windows.misc
  alt.windows98