At 09:21 AM 5/9/01 -0500, Julia wrote:
>There's a virus going through my husband's company this morning,
>homepage.XXX.vbs (the XXX is some sort of extension that he can't
>remember, as he's deleted the messages containing the virus).
>
>If you get something that's got "homepage" in the subject line today, be
>careful. (If you're working in a Windows environment, try to set your
>mailreader so it doesn't automatically execute attachments, if it's not
>set that way already.)
>
>I haven't received anything myself. (Yet.) If I get something and can
>figure out what the extension we're not sure about is, I'll pass that
>along.
From Wired News
<http://www.wired.com/news/culture/0,1284,43681,00.html>
New Worm a Marketing Ploy?
By Michelle Delio
10:51 a.m. May 9, 2001 PDT
A porn-peddling e-mail worm currently clogging computer networks in Asia,
Australia and Great Britain may be a misguided variation of an advertising
technique known as viral marketing.
Three Netherlands teenagers, who claim to be the virus' creators, said in
an e-mail that they created the worm to boost page views at four
pornography websites. They would not say whether they owned the sites or
were associated with the sites' owner.
They said they had high hopes that their virus would introduce people to
the "joys of being bad on the Net" and would also open a new career path
for them in "sneak advertising."
The worm, officially known as "VBSWG.X" and dubbed "Homepage," is
programmed to launch the default Web browser on an infected computer, and
then automatically open the homepage of one of four pornography websites.
"You could call this a sick form of viral marketing," said Dave Kroll,
director of security research at antiviral company Finjan. "It certainly
appears to be intended to drum up business for the pornography sites."
Kroll said that Homepage is the first computer worm-based advertisement
that he knows of.
"But it's really a stupid move," Kroll said. "It'd be very easy to find the
source of an ad worm if the advertiser is indeed the one who sent it out."
Viral marketing is an advertising technique that encourages individuals to
pass on advertising to other people.
Like computer viruses, viral marketing relies on rapid multiplication to
send its the message to as many people as possible, said Glenn Arkins, head
of client services at London advertising firm Admart.
Arkins said he's been joking for years about launching a viral-marketing
computer virus campaign, but never actually expected to see one in action.
But he doesn't think the concept will catch on with advertising agencies or
their clients.
"Somehow I doubt that anyone is going to think it's a great idea to annoy
their customers, break their computer networks and commit illegal acts in
order to promote their website," Arkins said.
But the teenagers who claim to have created the virus said they envied all
the attention that the creator of the "Anna Kournikova" e-mail worm
received. The author of the Kournikova worm, OnTheFly, is also from the
Netherlands.
OnTheFly eventually expressed remorse for releasing his worm into the wild.
The teenagers, who would not give their names and used an anonymous e-mail
service, said they thought it would be "cool" to "do something new with
OnTheFly's old virus."
According to Ken Dunham of security firm AtomicTangerine, Homepage appears
to be a slight modification of the Kournikova virus, which blitzed computer
networks in February.
The Homepage worm was created with the same downloadable virus writing kit
that Anna's author used.
The virus is activated only when the recipient clicks on the attachment, a
common newbie mistake. And it will only affect users of Microsoft's Outlook
e-mail program, arriving as a message with a subject line that reads
"Homepage."
The body of the message says "Hi! You've got to see this page! It's really
cool ;O)". Users who click on the attachment, called "homepage.html.vbs,"
infect their machines and will also soon be viewing a porn site.
The virus does not damage or delete files on a computer, but the number of
e-mail messages it generates could overwhelm some networks.
Dunham said that Homepage is spreading about four times faster than
Kournikova did earlier this year, and he thinks that Homepage "has not yet
reached its peak of proliferation."
A spokesman for the antiviral software company Sophos said that 80
companies have reported being hit by the virus, and several said that they
have each sent out up to 100,000 infected e-mails. Another antiviral firm,
MessageLabs, reports similar statistics, adding that its data indicates
Homepage is spreading faster than the Kournikova virus.
The first copy of the Homepage worm was spotted in the Netherlands Tuesday
night, and arrived in Britain from Asia and Australia on Wednesday morning.
It has hit media and financial companies in London, and government offices
in Australia.
Anti-virus experts said that the impact might be lighter in the United
States, since warnings were released before the virus arrived in many
e-mail boxes.
"Since the Love Bug, we have seen high-profile infections by the likes of
Anna Kournikova and the Naked Wife worm, both of which headed straight for
the groin -- and hit target," said Graham Cluley, senior technology
consultant at Sophos.
"It's pretty frustrating to see users being duped by the same old ruse time
and time again, especially when you consider that a combination of safe
computing practice and common sense could easily prevent these types of
viruses from spreading."
Copyright � 1994-2001 Wired Digital Inc. All rights reserved.
-- Ronn! :)
