What is this new "Bill Gates" virus people are talking
about?
VBS/Monopoly.
This is a self-emailing Visual Basic Script (VBS) worm which
masquerades as a joke.
Is it another Melissa?
It doesn't seem to be, otherwise we'd have had reports about it
spreading. We suggest adding protection for it, though, even though
it doesn't appear to be in-the-wild yet.
Is it dangerous?
All viruses are potentially dangerous (they are guilty of
unauthorised access and unauthorised modification even if they only
spread). Additionally, VBS/Monopoly leaks information from your
computer, so it could breach confidentiality. It also redistributes
itself from your computer via email to everyone in your address
book, so you can't deny having passed it on.
Why the excitement about it?
Probably because of the side-effects, which are a side-swipe at
Microsoft, rather than any dramatic danger. The virus pops up a
dialog claiming "Bill Gates is guilty of monopoly. Here is the
proof.". It then displays a picture showing a Monopoly board with
Bill Gates's picture in the middle and the corner squares (Free
Parking and Go To Jail) replaced with Microsoft images.
Why issue this warning about it, then?
This virus masquerades as a joke. It looks harmless, because it
has an overtly humorous side (which you see when you click on the
attachment) that serves to cover up its malevolent side
(redistributing itself in your name, and sending personal
information out of your company).
We want to warn people NOT to get in the habit of passing on
jokes, because this sets weak security standards. Don't dismiss
your system administrators as killjoys because they won't let you
have a bit of "fun". In the long run, they are helping establish a
safer working environment.
How can I protect against VBS/Monopoly?
For further information about this worm and how to detect it
please click here.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.