First published: 17th May 2001
Another new email worm spread around the world today. MessageLabs reported that it was first seen in Sri Lanka and had been stopped in at least 14 countries. The United Kingdom was the most-affected country.VBS/VBSWG.Z@MM, also known as VBS/Mawanella.A-mm, is an encrypted e-mail worm based on the same worm construction kit as VBS/SST-A - the Anna Kournikova worm and the more recent VBS/VBSWG.X - the Homepage worm.
It spreads by using the Outlook email application, sending messages with the following content:
Subject: MawanellaIf the attachment is opened, displays a message box saying "Please Forward this to everyone".
Body: Mawanella is one of the Sri Lanka's Muslim Village
Attachment: Mawanella.vbs
It then displays a window showing a burning house with the text:
"Mawanella is one of the Sri Lanka's Muslim Village.
This brutal incident happened here 2 Muslim Mosques & 100 Shops are burnt.
I hat this incident, What about you? I can destroy your computer
I didn't do that because I am a peace-loving citizen."
It copies itself to the Windows System directory as a file called "Mawanella.vbs" and e-mails itself to all recipients in the Microsoft Outlook address book.
Allan Dyer, Chief Consultant at Yui Kee Computing, said: "Unfortunately, some people have still not learn the lessons of Melissa, Loveletter, VBS/SST-A and VBS/VBSWG.X. This really was avoidable."
Users are advised to always practice "Safe Hex", see Sophos for details.
Further information on VBS/VBSWG.Z@MM is available from: