| Lasco | |
|---|---|
| Type | Email worm |
| Creator | Zulu |
| Date Discovered | 1999.08.08 |
| Place of Origin | Argentina |
| Source Language | Visual Basic |
| Platform | MS Windows |
| File Type(s) | .vbe, .vbs, .wsh |
| Infection Length | 52,073 bytes |
Monopoly is a Visual Basic worm, notable for displaying a parody Monopoly board with a picture of Bill Gates. It comes from the creator of Stages and Bubbleboy.
Behavior
Monopoly arrives in an email attachment named MONOPOLY.VBS. When executed, it creates the file "MONOPOLY.JPG" in a temporary folder, as well as "MONOPOLY.WSH" and "MONOPOLY.VBE". The .VBE file is executed from the .WSH file and it contains an encrypted Visual Basic Script file.
It displays the message "Bill Gates is guilty of monopoly. Here's proof." and then opens Internet Explorer to the MONOPOLY.JPG file. It is an image of Bill Gates in the center of a parody Monopoly board with things related to Microsoft in the place of some of the board spaces.
Monopoly searches Outlook for email addresses and sends an email message with itself attached. It also sends emails to the following email addresses containing information about the infected computers:
 |
|
| The Monopoly board |
|---|
- monopoly@mixmail.com
- monpooly@telebot.com
- mooponly@ciudad.com.ar
- mloponoy@usa.net
- yloponom@gnwmail.com
The information sent includes the user name and organization, the PC network name, DVD region, country and area code, the system language, version of Windows and the Internet Explorer Homepage.
Monopoly creates a Local Machine registry key under \Software\OUTLOOK.Monopoly, which is set to "True", to avoid infecting the same email address more than once.
Variants
There are three variants of Monopoly. Monopoly.A is 52,073 bytes long, Monopoly.B is 30,325 and Monopoly.C is 30,301. The first two in our tests fail to find the MONOPOLY.JPG file when it opens Internet Explorer. The third variant succeeds in this.
Origin
Monopoly was coded by Zulu, the creator of Bubbleboy and co-creator of Stages. Zulu is based in Argentina. It appeared in mid-summer of 1999.
Effects
It is uncertain whether the creator released the worm. No incidents were reported, so it is unlikely that it ever was.
Sources
VSAntivirus, "Bill Gates joke", el virus VBS/Monopoly. 1999.08.09
Frank Ziemann. TU Berlin, Internet-Wurm VBS/Monopoly.
Bruno Gerondi. ZDNet Latin America, 'Stages' scribe: 'I'm not fooling anybody'. 2000.06.22