[12252] in bugtraq
Re: I'm an idiot....
daemon@ATHENA.MIT.EDU (Dirro, Toralv)
Fri Oct 15 12:53:36 1999
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Message-Id: <A3315DCA3D89D21196BE00A0C9F277192D4616@ham-exchange1>
Date: Fri, 15 Oct 1999 07:32:01 -0700
Reply-To: "Dirro, Toralv" <Toralv_Dirro@NAI.COM>
From: "Dirro, Toralv" <Toralv_Dirro@NAI.COM>
X-To: Shawn Tagseth <stagseth@BBM.CA>, BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
>
> I knew it was an email worm. In the progress of erasing it I must of
> hit enter, or double clicked on it.
>
> Maybe my mouse should be taken away from me.....
>
>
> When the attached file is executed, it will create the following two
> files:
> C:\WINDOWS\LINKS.VBS
> C:\WINDOWS\SYSTEM\RUNDLL.VBS
> It will also create a file called LINKS.VBS in the root of all network
That verly likely is VBS/Freelink - any recent AV-Software should handle it.
If you're scanning, make sure to scan all files, as .vbs is not a default
extension in many products, yet! This also affects OnAccess Scanners, so be
aware.
best regards,
Toralv Dirro
Virus Research Engineer
Network Associates
AVERT, Central Europe
