[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT] VBS Script Summary (I love you)



It is a VBS script (Visual Basic Script) which on most Windows 95->2000
based machines is executable via. the C:\Windows\wscript.exe program. The
VBS extention is associated with this application.

Users save the attachment then run it, or run the attachment, and the
attachment modifies registry settings, deletes files, infects mIRC scripts
and HTML extensions, so on and so forth.

Nothing new really - like all viruses of this kind it is dependent on
the person running the attachment. It does not execute just by opening the
email. 

The code for the virus is now my desktop wallpaper at work. It's pretty
shocking from most programming standards :)

Cheers,
 Corey Popelier
 http://members.dingoblue.net.au/~pancreas
 Work Email: copo@commerce.wa.gov.au

On Fri, 5 May 2000, hingwah wrote:

> 
> 
> Nathan E Norman wrote:
> 
> > The attachment must be opened for infection to occur.
> >
> > On Fri, May 05, 2000 at 01:13:12AM +0800, hingwah wrote:
> > > How the virus work?It can infect immediately when opening the email but
> > > without open any attachment?
> > >
> > > Nathan E Norman wrote:
> > >
> > > > Put together by Morgan Sarges, one of our engineers.
> > > >
> > > > Regards,
> > > >
> > > > --
> > > > Nathan Norman         "Eschew Obfuscation"          Network Engineer
> > > > GPG Key ID 1024D/51F98BB7         http://home.midco.net/~nnorman/
> > > > Key fingerprint = C5F4 A147 416C E0BF AB73  8BEF F0C8 255C 51F9 8BB7
> > > >
> > > >   ------------------------------------------------------------------------
> > > >                Name: love.txt
> > > >    love.txt    Type: Plain Text (text/plain)
> > > >            Encoding: quoted-printable
> > > >
> > > >    Part 1.2Type: application/pgp-signature
> > >
> 
> What type of attachment?executable or script?
> is it only Microsoft Outlook (not outlook express) will be affected?
> 
> 
> 
> -- 
> Unsubscribe?  mail -s unsubscribe debian-user-request@lists.debian.org < /dev/null
> 


Reply to: