Type Email worm
Creator Zulu
Date Discovered 1999.08.08
Place of Origin Argentina
Source Language Visual Basic
Platform MS Windows
File Type(s) .vbe, .vbs, .wsh
Infection Length 52,073 bytes

Monopoly is a Visual Basic worm, notable for displaying a parody Monopoly board with a picture of Bill Gates. It comes from the creator of Stages and Bubbleboy.


Monopoly arrives in an email attachment named MONOPOLY.VBS. When executed, it creates the file "MONOPOLY.JPG" in a temporary folder, as well as "MONOPOLY.WSH" and "MONOPOLY.VBE". The .VBE file is executed from the .WSH file and it contains an encrypted Visual Basic Script file.


It displays the message "Bill Gates is guilty of monopoly. Here's proof." and then opens Internet Explorer to the MONOPOLY.JPG file. It is an image of Bill Gates in the center of a parody Monopoly board with things related to Microsoft in the place of some of the board spaces.

Monopoly searches Outlook for email addresses and sends an email message with itself attached. It also sends emails to the following email addresses containing information about the infected computers:

The Monopoly board

The information sent includes the user name and organization, the PC network name, DVD region, country and area code, the system language, version of Windows and the Internet Explorer Homepage.

Monopoly creates a Local Machine registry key under \Software\OUTLOOK.Monopoly, which is set to "True", to avoid infecting the same email address more than once.


There are three variants of Monopoly. Monopoly.A is 52,073 bytes long, Monopoly.B is 30,325 and Monopoly.C is 30,301. The first two in our tests fail to find the MONOPOLY.JPG file when it opens Internet Explorer. The third variant succeeds in this.


Monopoly was coded by Zulu, the creator of Bubbleboy and co-creator of Stages. Zulu is based in Argentina. It appeared in mid-summer of 1999.


It is uncertain whether the creator released the worm. No incidents were reported, so it is unlikely that it ever was.


VSAntivirus, "Bill Gates joke", el virus VBS/Monopoly. 1999.08.09

Frank Ziemann. TU Berlin, Internet-Wurm VBS/Monopoly.

Bruno Gerondi. ZDNet Latin America, 'Stages' scribe: 'I'm not fooling anybody'. 2000.06.22

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License