Path: chuka.playstation.co.uk!news
From: "ROBERT C SHAND" <bob@shand.org.uk>
Newsgroups: scee.yaroze.freetalk.english
Subject: Re: [Off topic]:  I luvvvvveee you
Date: Fri, 5 May 2000 11:54:45 +0100
Organization: PlayStation Net Yaroze (SCEE)
Lines: 53
Message-ID: <8eu977$4d51@chuka.playstation.co.uk>
References: <8esbbo$o571@chuka.playstation.co.uk> <8esvbq$o573@chuka.playstation.co.uk>
NNTP-Posting-Host: co3739.tay.ac.uk
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.00.2314.1300
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300

Ohh ouch, apparently you can muck about with some registry settings that
effectivly stop it from spreading.


Phil Gooch <phil@neuon.com> wrote in message
news:8esvbq$o573@chuka.playstation.co.uk...
> Yeah, we got stuffed by this at work. It's quite a nasty little virus, and
> once again shows how full of security holes Microsoft products are.
>
> It's a VB script that executes when you open the email in Outlook. As well
> as doing the Melissa stuff of sending itself to everyone in your address
> book, it installs itself on all drives (network or otherwise) that your
> computer is connected to. It also makes some changes to your registry so
> that it further propagates itself when you restart windows.
>
> Furthermore, it sets your Internet Explorer start page to a web site that
> downloads an executable to your IE downloads folder. It then makes a
> registry change so that this exe runs when you reboot. I don't know what
> this exe (called MSWIN-BUGFIX.exe) does.
>
> It also creates an HTML page, with the vb script itself embedded in it and
> infects mIRC (if you have it installed) so that this is sent out with all
> your IRC messages.
>
> Finally, and worst of all - and I can't believe MS allows VBscript to do
> this - it deletes *all* files on all your drives whose extensions are
.jpg,
> .jpeg, .mp3, .vbe, .vbs, .js and others, and then installs itself using
> these filenames as a disguise. So if you had a file called my.mp3 you end
up
> with my.mp3.vbs which is the virus.
>
> I ended up with 500 copies of the script on my system, each one sending
out
> emails to my whole address book at regular intervals. Plus it trashed a
> whole load of files on my machine.
>
> Phil
>
>
> ----------
> In article <8esbbo$o571@chuka.playstation.co.uk>, "ROBERT C SHAND"
> <bob@shand.org.uk> wrote:
>
>
> > Hrrmm, appears like most of the computer systems in the UK ( or even the
> > world) aren't ready for a widespread virus attack <g>
> >
> > Bob
> >
> >