Re: New worm?

[mer.concepcion () CODETEL NET DO (Edwin Concepcion)]

Yes, it's a new worm...My intranet is already infected..I recieved
an email this morning with the subject ILOVEYOU. As soon as I
got it, i deleted it, suspecting it was a kind of WORM.

I didn't read all of it, but the worm checks if the client has mIRC
installed, if it so, the worm will be sent to every user that enters
to the channel where the infected mortal is.

It also spreads like hell...

Edwin Concepcion

> I received two copies of this worm-looking thing this morning.  I don't
> have time to look myself before I head out, but I thought the list
> might be interested.  The second copy looks like someone who got it
> themselves and wants to know what it is.

> Attached is a zip, and inside it is another zip of the two files
> wrapped in their original mail headers.. so it should be pretty
safe unless you go out of your way to run them.  In which case,
caveat subscriber.

> It looks like VBScript, and has a .vbs extension, and diddles
> with reg keys, so I assume it's after windows boxen with WSH
> installed.

> BB