BEWARE OF VBS/MONOPOLY WORM

                     Monopoly is a VBScript worm, uses Microsoft OUTLOOK and it sends information about who runs the file. When run, it will display a message saying "Bill Gates is guilty of monopoly. Here is the proof.". Then it will show a JPG file, which shows Bill Gates face in the monopoly game.

.....

                     Monopoly has been created using Visual Basic Script and it works under Windows Scripting Host (WSH) version 5.0 or later. When the script is executed, it first creates three files to Windows temporary directory: "monopoly.jpg", "monopoly.whs" and "monopoly.vbe". After these files has been created, the worm will show a message box with the following text:

                     VBS/Monopoly attempts to mass mail itself to each recipient defined in the Outlook address lists. This message looks like the following:

Subject:         Bill Gates Joke
Body:              Bill Gates is a guilty monopoly. Here is the proof. :-)
Attachment:  Monopoly.vbs

Also, it will send an e-mail with information like name, organization, country, language, UIN files (from Icq), all names and addresses of the address book, Internet Explorer start page and more, to the addresses "monopoly@mixmail.com", "monpooly@telebot.com", "mooponly@ciudad.com.ar", "mloponoy@usa.net","yloponom@gnwmail.com".

The VBE code will check the registry for "HKEY_LOCAL_MACHINE\Software\OUTLOOK.Monopoly\", If it is true it will not be executed in the same machine.

How can I protect my system?

Fire has incorporated Monopoly into its virus signature file, with the aim of helping users affected by this Worm attack to detect and eliminate it from their systems. Fire anti-virus users can update this signature file from our web site.