Off Topic, but timely -- a for-real Virus Alert

O

Oatka

New member
From the Free republic message board - The little pencil-necked geeks are at it again.
http://www.freerepublic.com/forum/a391196413f22.htm#1

Basic Information on "I LOVE YOU" Macro Virus

Source: DOD

Received through my computer geeks

There is currently no fix for the "ILOVEYOU" macro worm that's been going around this morning. If you have opened the
"Loveletter.txt.vbs" you will have to turn off your computer until a fix is found because it infects your system registry and can cause other damage when restarted.

We will implement the fix as soon as it becomes available. Most DOD sites have been affected and as a result external mail connectivity has been shut off until a fix is found.

Below is the latest information we have on the virus:

*********

The DOD-CERT is aware of the "A-Love-Letter-For-You" email with the attachment of LOVELETTER.TXT.VBS. We are currently working with both Symantec and Network Associates. The current signatures and .dat files do not detect this virus (worm). In the meantime, if you do receive this email, PLEASE DELETE IT. DO NOT OPEN OR VIEW THE ATTACHMENT. Check back here often, as we will post the remedy when we get it from the vendor.

The information we have on LoveLetter is as follows: VBS/LoveLetter is a VBScript worm. It spreads thru email as a chain letter. The worm uses the Outlook e-mail application to spread. LoveLetter is also a overwriting VBS virus, and it spreads itself using mIRC client as well. When it is executed, it first copies itself to Windows System directory as:

- MSKernel32.vbs
- LOVE-LETTER-FOR-YOU.TXT.vbs

and to Windows directory:

- Win32DLL.vbs

Then it adds itself to registry, so it will be executed when the system is restarted. The registry keys that it adds are:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL


Next the worm replaces the Internet Explorer home page with a link that points to an executable program, "WIN-BUGSFIX.exe". If the file is downloaded, the worm adds this to registry as well; causing that the program will be executed when the system is restarted. After that, the worm creates a HTML file, "LOVE-LETTER-FOR-YOU.HTM", to the Windows System directory. This file contains the worm, and it will be sent using mIRC whenever the user joins an IRC channel. Then the worm will use Outlook to mass mail itself to everyone in each address book. The message that it sends will be as follows:

Subject: ILOVEYOU
Body: kindly check the attached LOVELETTER coming from me.
Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs

LoveLetter sends the mail once to each recipient. After a mail has been sent, it adds a marker to the registry and does not mass mail itself any more. The virus then searches for certain filetypes on all folders on all local and remote drives and overwrites them with its own code. The files that are overwritten have one of these extensions: ".vbs", ".vbe", ".js", ".jse", ".css", ".wsh", ".sct", ".hta" The virus also tries to use companion techniques, adding a secondary file next to existing file - hoping that the user will click on the wrong file. This is done so that the virus locates files with jpg, jpeg, mp3 and mp2 and adds a new file next to it. For example, a picture named "pic.jpg" will cause a new file called "pic.jpg.vbs" to be created. LoveLetter was found globally in-the-wild on May 4th, 2000. It looks like the virus is Philippine origin. At the beginning of the code, the virus contains the following text:

rem barok -loveletter(vbe) < i hate go to school>
rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group / Manila,Philippines
-- 30 --

One other member wrote: "Also, My IS department said to not even click on it as the preview window will trigger it, also not to delete it either--just stop using the box until further notice."

Those who use Macs or Sun UltraSPARC workstations appear to be immune.




------------------
The New World Order has a Third Reich odor.
 
Capitol punishment is a bit harsh - just register them like sex offenders. Imagine having your name, address, phone number and picture posted in a central location on the web after you just ticked off a few million people around the world...

BTW, we got it too. I've gotten 5 of those "ILOVEYOU" messages today. I had no idea I was that popular :)
 
Dave, that would end being capital punishment in the end (snicker) anyway, wouldn't it? ;)

MCI's been hit, but not really bad. This is a Good Thing, as a serious infestation would cut into my TFL time. :D
 
<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>This is a Good Thing, as a serious infestation would cut into my TFL time. [/quote]

Maaaannnnn! Three of our customers have it, one employee, AND the CEO! Plus, our AutoUpdate doesn't work, so I have go manually update EVERYone's system!
:(*whine!* Bye for now, TFL!

Death to Virus coders!
 
it's day's like this I hate to be a Microsoft Exchange manager :)

However, we have virus protection on the server which checks the mail queue..

so far, 35 messages with the attachment have been obliterated.

i'm just glad i didn't take the day off, or else I wouldn't have been able to update the virus signatures.

i've noticed that no matter how many time you tell your users NOT to open attachments, they do anyway...

talk about a call for capital punishment :)
 
Whoa! I got about a dozen of these little suckers in my mailbox this morning.

I had been forewarned by the sysop and deleted them pronto.

Skyhawk
 
I don't have to worry about Word macro viruses because we use WordPerfect. Don't have to worry about Outlook viruses because we use Groupwise.

Many viruses are written specifically for Microsoft applications.
 
Massive infestation at work. How dumb do you have to be to open an obviously non-work related email of which you see 40+ copies? Geez!

Knocked our Outlook down for several hours.
 
Spectre, you don't want to know. We had a user get nuked a couple of hours ago, although he got our highest-priority alert (including the .dat update) well in advance of the virus. He opened the friggin thing anyway.

Some people like to play train-tag, is how I look at it.
 
<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by TomMarker:
it's day's like this I hate to be a Microsoft Exchange manager :)
<snip>[/quote]

When it comes to MS Exchange, any day that contains a "y" qualifies as a hate to be the mail admin kind of day.

Being an MCSE, I've paid the dues to say that :(
If you *like* Exchange 5.2/5.5 you will *love* the 2000 version :(
 
If you click on the attachment it uses Outlook to replicate itself and if you are connected to the internet it will download a more complete version to hide itself within an altered operating system. I was not infected but the company was. We took the email server down and cleared it out before the virus overloaded the system. Outlook was down all day, only up now for internal use. Email outside the company (incoming or out going) should be available tomorrow.

[This message has been edited by Jeff OTMG (edited May 04, 2000).]
 
Hackers and virus makers need to be executed. Their unfocussed screwing around could cause an economic collapse. Little punks.
They are just as dangerous as North Koreans with Nuclear weapons.
 
You must log in or register to reply here.
Back
Top