[no subject]

["Hedges, Nigel" <Nigel.Hedges () CA COM>]

Thanks Blackhand,

VBSWG.X (also known as VBS.VBSWG.X and VBS.Homepage)
Vet update 1205 includes detection for it.
And InoculateIT.

I'd be surprised if most of the other major vendors haven't already got
detection against this variant.

Still worth posting about.

Cheers,

Nigel Hedges
Computer Associates
Technical Consultant (FSG Pre-Sales EM South)
Level 5 441 St.Kilda Rd
Melbourne VIC 3004
Ph: +613 9821 3195
Fax : +613 9821 3010
Mob : +613 413 483 436
Email: nigel.hedges () ca com

 -----Original Message-----
From:   black-hand [mailto:black () WIRETAPPED NET]
Sent:   Wednesday, 9 May 2001 3:35 PM
To:     INCIDENTS () SECURITYFOCUS COM
Subject:        homepage worm

Hi,

There is a new VBS worm doing its rounds down here in Australia at the
moment, a lot of virus scanners arnt picking it up. Its not a malicious
payload, but still..

ive put up the email, attachment and payload info here:

http://black.wiretapped.net/homepagevirus.asp

to bypass virus scanners, it does a simple decypher then execute

black-hand
wiretapped - 2600 australia
http://black.wiretapped.net