VBS/Staple-A

Please follow the instructions for disinfecting macro viruses.

VBS/Staple-A is a simple Visual Basic Script worm which uses Microsoft Outlook to replicate.

The worm arrives in an email message with the following characteristics:

Subject:
RE:Injustice

Message body:
Dear <name>

Did you send the attached message. I was not expecting this from you !

Attached filename:
injustice.txt.vbs

If the attached file is executed, it counts the number of addresses in the Outlook address book and sets a variable to either 50 or to the number of address book entries if the number is less than 50.

It then uses Outlook to send the worm file to randomly chosen entries from Outlook's address book. It sends this email only once for every chosen address.

It also sends a message with the same subject and the text
"Dear sir
Did you send the attached message, I was not expecting this from you !"

to the following email addresses:

sar@mod.gov.il
sar@mops.gov.il (twice)
sar@moin.gov.il
yor@knesset.gov.il (twice)
webmaster@israel.com
amuta@ehudbarak.co.il
foundation@habonimdror.org
wlzm@jazo.org.il
office@JAFI.org.il
naamatusa@naamat.org
info@azm.org
arie@kba.org
ncli@laborisrael.org
holyland@inisrael.com
sar@mof.gov.il
hachnasot@mof.ov.il
doar@mof.gov.il
mafkal@police.gov.il
rmarkus@parliament.gov.il
doar@shaam.gov.il
hashkal@mof.gov.il
pniotmas@mof.gov.il
menahel@shaam.gov.il

The worm then runs Internet Explorer and opens the following URLs, each in a new window:

www.sabra-shatila.org
www.petitononline.com/palpet
/petition.html
www.palestine-info.org
freesaj.org.uk
hanthala.virtualave.net
www.ummah.net/unity/palestine/index.htm

The websites appear to be pro-Palestinian political websites.

The worm also contains the following lines within its code which do not get displayed:

Note:
Do not worry. This is a harmless virus. It will notdo any thing to your system. The intesion is to help Palestinian people to leave in PEASE in their own land.

Finally the worm displays a message box with the caption

HELP US TO STOP THE BLOOD SHED !!

containing the text:

PLEASE ACCEPT MY APOLOGIES FOR DISTURBING YOU

Remember that one day YOU may be in this situation. We need every possible help.

Israeli soldiers killed in cold blood 12 year old Palestinian child Mohammad Al-Durra, as his father tried to protect him in vain with his own body. As a result of indiscriminate and excessive use of machine gun fire by Israeli soldiers, journalists and bystanders watched helplessly as the child was savagely murdered. Palestinian Red Crescent Society medic Bassam Balbeisi attempted to intervene and spare the child's life but live ammunition to his chest by Israeli took his life in process. The child and the medic were grotesquely murdered in cold blood. Mohammad's father, Jamal, was critically injured and permanently paralyzed. Similarly. approximately 40 children were slain, without the media taking notice or covering these tragedies.

THESE CRIMINAL ACTS CANNOT BE FORGIVEN OR FORGOTTEN!!!!