Article View: demon.tech.pc
Article #22818Re: Has anyone received the new "I LOVE YOU" Virus email yet ?
From: 'Dungeon' Dave
Date: Fri, 05 May 2000 00:00
Date: Fri, 05 May 2000 00:00
22 lines
1457 bytes
1457 bytes
.. and it came to pass that barry.morgan <barry.morgan@ntlworld. com> uttered forth: > <snip> > >Have heard that disabling Windows Scripting Host stops these sort of >attacks >in the first place. Any comment anyone - I've done it anyway just in case >:-) > Not in this case - the source code looks as though it creates a folder and flicks on Windows Scripting so that the WIN- BUGFIX.EXE trojan can download and run unnoticed. However, I'm not a VB expert - I'm just guessing by the reg-key lines that are embedded in the code. -- "Dungeon" Dave, in anti-harvest mode... From: abuse@yahoo.com From: abuse@btinternet.com From: *@localhost
Technical Details
Message-ID:
<XEIKoEA8A0E5Ew+C@ghastly.demon.co.uk>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<Jaw4iIAg5VE5EwNK@hitechuk.demon.co.uk> <NAomfyA6JwE5Ewch@equipoise.demon.co.uk> <ZVFQ4.8098$E44.194907@news6-win.server.ntlworld.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 1036bc,cc294bbc93feefe4 X-Google-Attributes: gid1036bc,public From: 'Dungeon' Dave <Dungeon@SpamNot.Here> Subject: Re: Has anyone received the new "I LOVE YOU" Virus email yet ? Date: 2000/05/05 Message-ID: <XEIKoEA8A0E5Ew+C@ghastly.demon.co.uk> X-Deja-AN: 619761238 X-NNTP-Posting-Host: ghastly.demon.co.uk:193.237.153.154 References: <Jaw4iIAg5VE5EwNK@hitechuk.demon.co.uk> <NAomfyA6JwE5Ewch@equipoise.demon.co.uk> <ZVFQ4.8098$E44.194907@news6-win.server.ntlworld.com> X-Complaints-To: abuse@demon.net X-Trace: news.demon.co.uk 957564223 nnrp-13:21227 NO-IDENT ghastly.demon.co.uk:193.237.153.154 Organization: Blank MIME-Version: 1.0 Reply-To: 'Dungeon' Dave <Dungeon@Ghastly.Demon.Co.UK> Newsgroups: demon.tech.pc