Bugtraq mailing list archives

I'm an idiot....


From: stagseth () BBM CA (Shawn Tagseth)
Date: Tue, 12 Oct 1999 15:05:40 -0400


Regarding that stupid message that I just sent:

I knew it was an email worm.  In the progress of erasing it I must of
hit enter, or double clicked on it.

Maybe my mouse should be taken away from me.....

When the attached file is executed, it will create the following two
files:
C:\WINDOWS\LINKS.VBS
C:\WINDOWS\SYSTEM\RUNDLL.VBS
It will also create a file called LINKS.VBS in the root of all network
drives that are currently mapped. Next, the worm will modify the
following registry to execute every time the machine boots up:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run\Rundll=RUNDLL.VBS
After infecting a system, it will displays a dialog box title "Free XXX
links" with following content:
This will add a shortcut to free XXX links on your desktop. Do you want
to continue.
If the user selects yes, it will create a shortcut pointing to an adult
web
site.
It also searches for MIRC32.EXE and PIRCH98.EXE chat programs in C:\MIRC
,
C:\PIRCH98, C:\PROGRAM FILES and the sub directories of each of these
directories. If it finds either of these programs, it will modify the
corresponding SCRIPT.INI file or EVENTS.INI located in the same
directory.  These INI files will cause LINKS.VBS to be sent to other
people  during the IRC sessions.


Current thread: