This is the mail archive of the xsl-list@mulberrytech.com mailing list .


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]

Getting rid of the virus


Hi, everyone.

The little VB script you all received does the following
(the order of events is not accurate):

1. It sends the e-mail containing the script to all Outlook
   contacts you might have.
2. Removes all JPG, JPEG and MP3 files and puts the virus
   at the same path, with the ".vbs" extension.
3. Replaces the content of all VB scripts you might have on
   your system with the virus (i.e., all ".vbs" and ".vbe"
   files).
4. Creates a "script.ini" file that sends the e-mail
   to all Outlook contacts.

In short, it is a nasty thing! All your VB scripts and
JPEGs get deleted (and replaced).

My suggestion is to:

1. Search for all ".vbs" files in the system and REMOVE ALL OF THEM.
   You can always check whether the scripts are infected by using
   "edit" (NOT "open"!!!). This will include two scripts that are
   put in the system folders, MSKernel32.vbs and Win32DLL.vbs.
2. Search for "script.ini" and remove it.
3. Change your registry keys
	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
   and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win
32DLL
   to what they were before. The chances are that you never used them,
   so blank them for now, if you do not know the previous values.

You will definitely encounter a lot of problems with Windows themes
and documentations, since all VBS and JPEGs are gone.

If you need further assistance, e-mail me.

/David

-----Original Message-----
From: owner-xsl-list@mulberrytech.com
[mailto:owner-xsl-list@mulberrytech.com]On Behalf Of John Robert Gardner
Sent: Thursday, May 04, 2000 10:37
To: 'Xsl-List (E-mail)
Subject: **DON'T -- Re: ILOVEYOU


Kindly DON'T . . . rumor has it it's a VBScript virus . . .

On Thu, 4 May 2000, Tim Mogler wrote:

>
> kindly check the attached LOVELETTER coming from me.
>
>


 XSL-List info and archive:  http://www.mulberrytech.com/xsl/xsl-list


 XSL-List info and archive:  http://www.mulberrytech.com/xsl/xsl-list

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]