The same worm generator kit that was used to create last week's Homepage worm has been put to use once again. This time, the kit gives us Manawella (also known as VBSWG2-Z@mm). Manawella is unusual: its success is surprising those in the antivirus community because of its limited social appeal (in other words, it doesn't promise sex), and Manawella doesn't try to hide its .vbs extension by pretending to be a .jpg or any other file (most computer systems should already be blocking .vbs files). Manawella is not destructive, although it could overwhelm email servers with the volume of mail it sends.
How it works
Manawella arrives as an email with the following information:
Subject: Mawanella
Body: Mawanella is one of the Sri Lanka's Muslim Village
Attachment: Mawanella.vbs
If a user clicks on the attachment, Manawella displays a message box saying "Please Forward this to everyone." Mawanella then gains access of the user's Microsoft Outlook address book and sends copies of itself to all the addresses found. Manawella also displays an image showing a burning house with the following text:
"Mawanella is one of the Sri Lanka's Muslim Village. This brutal incident happened here 2 Muslim Mosques & 100 Shops are burnt. I hate this incident, What about you? I can destroy your computer I didn't do that because I am a peace-loving citizen."
