Vulnerability Development mailing list archives
Re: New worm?
From: mer.concepcion () CODETEL NET DO (Edwin Concepcion)
Date: Thu, 4 May 2000 10:34:40 -0400
Yes, it's a new worm...My intranet is already infected..I recieved an email this morning with the subject ILOVEYOU. As soon as I got it, i deleted it, suspecting it was a kind of WORM. I didn't read all of it, but the worm checks if the client has mIRC installed, if it so, the worm will be sent to every user that enters to the channel where the infected mortal is. It also spreads like hell... Edwin Concepcion
I received two copies of this worm-looking thing this morning. I don't have time to look myself before I head out, but I thought the list might be interested. The second copy looks like someone who got it themselves and wants to know what it is.
Attached is a zip, and inside it is another zip of the two files wrapped in their original mail headers.. so it should be pretty
safe unless you go out of your way to run them. In which case, caveat subscriber.
It looks like VBScript, and has a .vbs extension, and diddles with reg keys, so I assume it's after windows boxen with WSH installed.
BB
Current thread:
- Re: New worm? Greene, Patrick (May 04)
- <Possible follow-ups>
- Re: New worm? Jim Swanson (May 04)
- Re: New worm? Matthew R. Potter (May 04)
- Re: New worm? Bluefish (May 05)
- Re: New worm? Matthew R. Potter (May 04)
- Re: New worm? mick chang (May 04)
- Re: New worm? Rich Corbett (May 04)
- Re: New worm? Edwin Concepcion (May 04)
- Re: New worm? Todd C. Campbell (May 10)
- Re: New worm? Dan Schrader (May 11)
- Re: New worm? Dimitry Andric (May 12)
- Re: New worm? Thierry Zoller (Apr 13)
- ScriptGuard Crispin Cowan (May 16)
- Re: ScriptGuard Thierry Zoller (Mar 16)
- Re: ScriptGuard Tim Wort (May 16)
- Re: ScriptGuard Chon-Chon Tang (May 16)
- warftpd exploit? Martin Ixter (May 16)
- Re: New worm? Dimitry Andric (May 12)
- Re: New worm? Bernie Cosell (May 12)