Subject: FW: ATTENTION--new email attachment virus warning
Date: Aug 11 12:13:03 1999
From: Korpi, Raymond - RKorpi at clark.edu


Given the recent attachment virus that was transmitted on Tweeters, I
thought people might want to watch out for this one (especially in Redmond,
WA!!)
RK

Ray Korpi
rkorpi at clark.edu
Portland, OR/Clark College, Vancouver WA
President, Oregon Field Ornithologists

> -----Original Message-----
> From: Taylor, Patrick
> Sent: Wednesday, August 11, 1999 11:05 AM
> To: Campus Master List
> Subject: ATTENTION--new email attachment virus warning
>
> Good afternoon,
>
> We have received a new email attachment virus warning that we would like
> to inform you about. The following is the official information and
> description of the virus.
>
> As a reminder, please use caution when dealing with attachments if you are
> not sure of their origin, since the attachment must be executed (opened)
> in order for the virus to infect your machine.
>
> Thank you.
>
> Pat
>
> Description:
> VBS.Monopoly is an encrypted worm that will work under Windows operating
> systems which support Visual Basic Script 4.0 and above. The worm utilizes
> Microsoft Outlook to send a copy of itself to all the recipients in the
> user's MS Outlook Address Book. The worm usually appears as 'MONOPOLY.VBS'
> in the email.
>
> Technical Details:
> Similar to VBS.Freelink </avcenter/venc/data/vbs.freelink.html>, the worm
> is written in Visual Basic Script. When launched, the worm drops a picture
> named 'MONOPOLY.JPG' in the temporary folder. It also creates
> 'MONOPOLY.WSH' and 'MONOPOLY.VBE' files.
> The 'MONOPOLY.WSH' executes the 'MONOPOLY.VBE'. The latter sends out an
> email to everyone in the user's MS Outlook Address Book. The email has the
> following subject and message:
>
> Subject:
> Bill Gates joke
>
> Message:
> Bill Gates is guilty of monopoly. Here is the proof.
> :-)
>
> After executing the MONOPOLY.VBE file, the worm displays a message:
> Bill Gates is guilty of monopoly. Here is the proof.
>
> It then displays the picture file MONOPOLY.JPG on your screen.
>
>