Pennock's Fiero Forum
  Totally O/T - Archive
  Nasty Virus

T H I S   I S   A N   A R C H I V E D   T O P I C
  

Email This Page to Someone! | Printable Version


Nasty Virus by Raydar
Started on: 05-04-2000 05:45 PM
Replies: 9
Last post by: Raydar on 05-06-2000 06:35 PM
Raydar
Member
Posts: 38922
From: Carrollton GA. Out in the... country.
Registered: Oct 1999


Feedback score:    (12)
Leave feedback





Total ratings: 455
Rate this member

Report this Post05-04-2000 05:45 PM Click Here to See the Profile for RaydarClick Here to Email RaydarSend a Private Message to RaydarDirect Link to This Post
Okay... I suspect you all have heard about this, already.
There is a virus similar to "Melissa" going around.
If you receive an e-mail message with the Subject: ILOVEYOU, delete it. Do not open it.
There is a .vbs attachment that is really nasty. Check this link for more info, technical details. http://www.europe.datafellows.com/v-descs/love.htm
IP: Logged
PFF
System Bot
Boodoggin
Member
Posts: 93
From: Eagle, ID, USA
Registered: Apr 2000


Feedback score: N/A
Leave feedback

Rate this member

Report this Post05-04-2000 06:28 PM Click Here to See the Profile for BoodogginClick Here to Email BoodogginSend a Private Message to BoodogginDirect Link to This Post
Raydar- My mom works for Albertsons corporate headquaters a lot of people got it and they had to practically shut down the entire place today.
IP: Logged
Cliff Pennock
Administrator
Posts: 10933
From: Haarlem, The Netherlands
Registered: Jan 99


Feedback score: (2)
Leave feedback





Total ratings: 698
Rate this member

Report this Post05-04-2000 06:45 PM Click Here to See the Profile for Cliff PennockClick Here to visit Cliff Pennock's HomePageClick Here to Email Cliff PennockSend a Private Message to Cliff PennockDirect Link to This Post
That's exactly the reason why I hate the fact Windows hides extensions by default. The attachement is actually a VBScript with the extension ".vbs". But since this is a known extension by Windows, it is hidden. The guy (or girl?) who wrote the script gave it the name "iloveyou.txt.vbs". Windows hides ".vbs", leaving "iloveyou.txt" which looks like an innocent text-file. But if you open it, the script is run.

To unhide know extensions (which you should always do on any computer), follow these instructions:

  • Open Windows Explorer
  • Click "View"
  • Click "Folder Options" (or just "Options, I'm not sure what it is called in the English version)
  • Click on the second Tab ("View"? Again, I'm not sure what it is called)
  • One of the first options (if not the first) should be something like "Hide extensions for known filetypes". Uncheck this.
IP: Logged
pherder
Member
Posts: 925
From: Sedgwick, KS
Registered: Aug 99


Feedback score: N/A
Leave feedback

Rate this member

Report this Post05-04-2000 07:57 PM Click Here to See the Profile for pherderSend a Private Message to pherderDirect Link to This Post
Raytheon got it today ... bad!

Guess what I did all day?

Paul

IP: Logged
GT Bastard
Member
Posts: 2243
From: Rapid City, SD
Registered: Sep 1999


Feedback score: N/A
Leave feedback

Rate this member

Report this Post05-04-2000 09:48 PM Click Here to See the Profile for GT BastardClick Here to visit GT Bastard's HomePageClick Here to Email GT BastardSend a Private Message to GT BastardDirect Link to This Post
Oh boy, and I work tomorrow... This means that we're going to have thousands of people calling with this virus expecting us to fix it for them. Then they get ticked-off when I tell them to call Mcafee or Norton because it's not an 800# and the phones always ring busy anyways!!!
IP: Logged
Shiner
Member
Posts: 899
From: Riegelsville, PA, USA
Registered: May 99


Feedback score: N/A
Leave feedback

Rate this member

Report this Post05-04-2000 11:52 PM Click Here to See the Profile for ShinerClick Here to Email ShinerSend a Private Message to ShinerDirect Link to This Post
Do this also:
Go to control panel, add/remove programs, windows setud, accessories, and uncheck "windows script hosting"
Come and get me, Iloveyou virus!!!
IP: Logged
theogre
Member
Posts: 29976
From: USA
Registered: Mar 99


Feedback score: N/A
Leave feedback





Total ratings: 558
Rate this member

Report this Post05-05-2000 02:57 PM Click Here to See the Profile for theogreClick Here to visit theogre's HomePageSend a Private Message to theogreDirect Link to This Post
I've been talking to some of our programmers here that have looked at the actual code for this.

This one was a problem. Watch out for the ones that are comming. Those will likely delete allot more than a images and sounds.

This virus code was very tight. There is a frightening amount of hoarse power in the tiny size of it. (The part of the program hat searches you drives was around 9 lines.)

I strongly recomend NOT opening attachements of any kind unless you know exactly what they are. no matter what extension they have.

To view the Real extensions of programs:
(Win95)
open my computer.
click options under the view menu.
click the show all files button.
UNcheck the "hide ms-dos..." box.

(Win98)
((I'll add this from home later. It's enough differant I can't remember all the details.))


These setttings are global and effect all places that display file names.


In outlook and outlook express TURN OFF both the preview pane, and the autopreview. These functions automatically open mail a soon as it is higlighted and/or as soon as it's recieved. Some classes of email virus will activate from these functions. (Thankyou microsoft for ActiveX, not.)

[This message has been edited by theogre (edited 05-05-2000).]

IP: Logged
1FST2M6
Member
Posts: 3905
From: Dallas, GA.
Registered: Jan 2000


Feedback score: N/A
Leave feedback





Total ratings: 66
Rate this member

Report this Post05-05-2000 04:01 PM Click Here to See the Profile for 1FST2M6Click Here to visit 1FST2M6's HomePageClick Here to Email 1FST2M6Send a Private Message to 1FST2M6Direct Link to This Post
that virus WIPED OUT The City of Marietta. my girlfriend works there and they all got leave early (2:30)yesterday, but the lucky computer people were there till 11 this morning fixing it...
IP: Logged
Robert
Member
Posts: 433
From: One gallon East of San Francisco
Registered: May 99


Feedback score: N/A
Leave feedback

Rate this member

Report this Post05-06-2000 09:50 AM Click Here to See the Profile for RobertClick Here to visit Robert's HomePageClick Here to Email RobertSend a Private Message to RobertDirect Link to This Post
Iím starting to feel ďunlovedĒ. I havenít seen the virus at home or at work. I havenít spoken to anyone face to face that has seen this virus either. I know itís something I really donít want. Did anyone out there get the virus at home?
IP: Logged
Raydar
Member
Posts: 38922
From: Carrollton GA. Out in the... country.
Registered: Oct 1999


Feedback score:    (12)
Leave feedback





Total ratings: 455
Rate this member

Report this Post05-06-2000 06:35 PM Click Here to See the Profile for RaydarClick Here to Email RaydarSend a Private Message to RaydarDirect Link to This Post
Robert,
Don't feel too "rained upon".
The virus was the nastiest one I've ever seen. (Not like I've seen that many, though.) You *really don't* want to see it.
Fortunately, I haven't seen it on any of my personal accounts.

Also... There are a number of copycat viruses floating around. The nastiest one is called "mother's day gift" or some such.
The body of the note says something to the effect of:
"This is to confirm your recent jewelry order. The total comes to $256. To see a copy of the invoice, click the attachment."
When you click the attachment, it replicates like the "Love You" virus, except that it deletes ".bat" and ".ini" files.
Be careful, guys and ladies.

IP: Logged



All times are ET (US)

T H I S   I S   A N   A R C H I V E D   T O P I C
  

Contact Us | Back To Main Page

Advertizing on PFF | Fiero Parts Vendors
PFF Merchandise | Fiero Gallery | Ogre's Cave
Real-Time Chat | Fiero Related Auctions on eBay



Copyright (c) 1999, C. Pennock