|Place of Origin||Argentina|
|Source Language||Visual Basic|
|File Type(s)||.vbe, .vbs, .wsh|
|Infection Length||52,073 bytes|
Monopoly arrives in an email attachment named MONOPOLY.VBS. When executed, it creates the file "MONOPOLY.JPG" in a temporary folder, as well as "MONOPOLY.WSH" and "MONOPOLY.VBE". The .VBE file is executed from the .WSH file and it contains an encrypted Visual Basic Script file.
It displays the message "Bill Gates is guilty of monopoly. Here's proof." and then opens Internet Explorer to the MONOPOLY.JPG file. It is an image of Bill Gates in the center of a parody Monopoly board with things related to Microsoft in the place of some of the board spaces.
Monopoly searches Outlook for email addresses and sends an email message with itself attached. It also sends emails to the following email addresses containing information about the infected computers:
|The Monopoly board|
The information sent includes the user name and organization, the PC network name, DVD region, country and area code, the system language, version of Windows and the Internet Explorer Homepage.
Monopoly creates a Local Machine registry key under \Software\OUTLOOK.Monopoly, which is set to "True", to avoid infecting the same email address more than once.
There are three variants of Monopoly. Monopoly.A is 52,073 bytes long, Monopoly.B is 30,325 and Monopoly.C is 30,301. The first two in our tests fail to find the MONOPOLY.JPG file when it opens Internet Explorer. The third variant succeeds in this.
It is uncertain whether the creator released the worm. No incidents were reported, so it is unlikely that it ever was.
VSAntivirus, "Bill Gates joke", el virus VBS/Monopoly. 1999.08.09
Frank Ziemann. TU Berlin, Internet-Wurm VBS/Monopoly.
Bruno Gerondi. ZDNet Latin America, 'Stages' scribe: 'I'm not fooling anybody'. 2000.06.22