[766] in winnt
Re: new virus
daemon@ATHENA.MIT.EDU (Kerem B Limon)
Tue Jan 15 14:33:55 2002
Mime-Version: 1.0
Message-Id: <p05101007b86a336e939d@[18.152.2.36]>
In-Reply-To: <5.0.2.1.2.20020115134930.06bb0d30@hesiod>
Date: Tue, 15 Jan 2002 14:33:58 -0500
To: Carrie Groves <cgroves@mit.edu>
From: Kerem B Limon <kerem.limon@MIT.EDU>
Cc: ntpartners@mit.edu, gii@mit.edu
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Yes, to the best of my knowledge, you are right. NT/2000/XP may parse
AutoExec.bat for environment variables and path entries, however. See
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q100843
http://www.windows2000faq.com/Articles/Index.cfm?ArticleID=14948
for how this works, and
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q124551
http://www.windows2000faq.com/Articles/Index.cfm?ArticleID=14823
on how to control AutoExec.bat parsing
There are other viruses like W32/Vote which do the same (among
others). It is certainly something to watch out for, considering a
lot of people using NT 4 at work tend to "sneaker-net" files back and
forth between work and home machines, most of which tend to be non-NT
Windows flavors who would be hit hard.
Kerem
At 14:02 hrs -0500 02/01/15, Carrie Groves wrote:
>There is a new virus going around called JS.Gigger.A@mm that I'm
>sure you've heard of.
>(http://www.windows2000faq.com/Articles/Index.cfm?ArticleID=14823)
>One of the things it does is add a "format c:" to the autoexec.bat
>file which executes upon the next reboot. I am writing to verify
>that this command will not work upon reboot on an NT 4.0 system
>because this OS does not use the autoexec.bat to boot up. Is this
>right? Or does it use the autoexec.bat file with the format c:
>because the virus tells it to? I know no virus is safe but I want to
>make sure people in my area understand what this virus does.
>
>Thank you,
>
>Carrie Groves
>Network Administrator, SSIT
>Massachusetts Institute of Technology
>77 Massachusetts Ave 12-145
>Cambridge, Ma 02139
>(617)258-0714
><mailto:cgroves@mit.edu>
