The VBS/VBSWG.AF (a.k.a "Antrax") Virus is a Bunch of Marketroid Hype

This information can be freely reproduced in any medium, as long as the information is unmodified.

Thanks to antivirus expert Costin Raiu for providing some of the technical details used in this report.

N.B.: U-M users of VirusScan have been protected heuristcally by this since the 23 March, 2001 virus definitions (v.4131 datfiles); most other major products detect this generically as well. It does not affect Mac users at all.

This is a case of appallingly bad judgement and poor taste by an antivirus company in choosing a name for a virus.

Here is the scoop: Some virus weenie used a virus creation kit to make a virus -- or, more precisely, try to write a virus: parts of it don't work. In particular, the "mass mailing" part is sterile, which makes it unlikely to spread "In The Wild." It does have parts that do replicate, but these are unlikely to be successful.

Anyway, said developmentally challenged k3Wl d00d instructed the virus generator to display a message that reads in part "Antrax worm".

And that should have been the end of it.

The first antivirus company to see this should have analyzed it, said "Oh, another boring VBS/VBSWG variant. Let's see now: We have VBSWG.A, VBSWG.B, ... VBSWG.AD, and VBSWG.AE, so this must be VBSWG.AF."

Unfortunately, in a tragedy of errors, the first antivirus company to see this:

• was a minor player, and one known for ethical mis-steps in the recent past
• apparently did not notice that this was an VBSWG variant (though how one could miss this, and be considered any sort of antivirus "expert" is difficult to conceive)
• was morally challenged enough not to realize the hazards of naming this "Antrax", given today's climate
• was unaware of a virus named "Anthrax" that has been known since at least 1990 -- or was fully aware, but decided to name it as they did for despicable marketing "value"
• announced this virus to a group of antivirus vendors as being a credible threat (!@#$% marketroids!)
• said announcement allowed them to make a press release about this non-threat
• probably due to antivirus industry pressure, have seen fit to rename this to a VBS/VBSWG variant (this is the only thing that isn't unfortunate in this whole mess)
• have not seen fit to post a retraction or any similar indication of remorse on their web site

In my opinion, this was an intentional attempt to capitalize on the post- 11 September 2001 mood to sell copies of an inferior antivirus product.

Once the cat was out of the bag, of course other vendors had to react; some of them did a poor job of it, magnifying the hype.

In addition, some of the mews media appear to have picked up on this non-event; had these "journalists" done even remedial fact-checking, they would have known better. Nowadays, sad to say, this seems too much to expect. -(

Other antivirus vendors have been exemplary in their behavior:

• They have not mentioned this ill-advised name as an alias at all: better to let it die away. When they do mention it, some are not mentioning the perpetrators by name (though the guilty certainly deserve public approbation).
• They have not hyped the situation; some have even tried to calm the waters
• They have given it the boring name it so richly deserves
• They have mentioned that it is no credible threat, and that it is not known to be In The Wild

  Summary: this is a very pathetic, run-of-the-mill almost non-virus that, for marketing gain, has been hyped by a minor antivirus company. Don't let the marketroids succeed; ignore this.

Please do not forward warnings about this -- or any other marketing hype or hoax -- to all your friends.

Instead, you should reply to the sender -- and as far back up the email chain as you have energy -- informing the originators that this is rubbish designed to sell product. For this particular nonsense, I suggest that you provide a pointer to this URL (http://www.umich.edu/~virus-busters/vbswg-af.html)
For virus or hoax info, please see our main page (http://www.umich.edu/~virus-busters/) or go to another reputable site, like The Urban Legends Reference Pages (leaving our site).

   -BPB