This is the mail archive of the
xsl-list@mulberrytech.com
mailing list .
Getting rid of the virus
- To: <xsl-list at mulberrytech dot com>
- Subject: Getting rid of the virus
- From: "David Bergman" <davidb at home dot se>
- Date: Thu, 4 May 2000 11:58:43 -0400
- Reply-To: xsl-list at mulberrytech dot com
Hi, everyone.
The little VB script you all received does the following
(the order of events is not accurate):
1. It sends the e-mail containing the script to all Outlook
contacts you might have.
2. Removes all JPG, JPEG and MP3 files and puts the virus
at the same path, with the ".vbs" extension.
3. Replaces the content of all VB scripts you might have on
your system with the virus (i.e., all ".vbs" and ".vbe"
files).
4. Creates a "script.ini" file that sends the e-mail
to all Outlook contacts.
In short, it is a nasty thing! All your VB scripts and
JPEGs get deleted (and replaced).
My suggestion is to:
1. Search for all ".vbs" files in the system and REMOVE ALL OF THEM.
You can always check whether the scripts are infected by using
"edit" (NOT "open"!!!). This will include two scripts that are
put in the system folders, MSKernel32.vbs and Win32DLL.vbs.
2. Search for "script.ini" and remove it.
3. Change your registry keys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win
32DLL
to what they were before. The chances are that you never used them,
so blank them for now, if you do not know the previous values.
You will definitely encounter a lot of problems with Windows themes
and documentations, since all VBS and JPEGs are gone.
If you need further assistance, e-mail me.
/David
-----Original Message-----
From: owner-xsl-list@mulberrytech.com
[mailto:owner-xsl-list@mulberrytech.com]On Behalf Of John Robert Gardner
Sent: Thursday, May 04, 2000 10:37
To: 'Xsl-List (E-mail)
Subject: **DON'T -- Re: ILOVEYOU
Kindly DON'T . . . rumor has it it's a VBScript virus . . .
On Thu, 4 May 2000, Tim Mogler wrote:
>
> kindly check the attached LOVELETTER coming from me.
>
>
XSL-List info and archive: http://www.mulberrytech.com/xsl/xsl-list
XSL-List info and archive: http://www.mulberrytech.com/xsl/xsl-list