Messages in this thread | | | From | "William Scott Lockwood III" <> | Subject | VIRUS ALERT! THIS IS NOT A DRILL! | Date | Thu, 3 Feb 2000 09:20:22 -0600 |
| |
Hello to EVERYONE in my address book:
Yesterday I was hit by a "virus" that may have replicated and mailed itself to everyone in my address book. I'm very sorry about this. I didn't send this out right away, because I wanted to know what to do about it FIRST. With that in mind, here's the scoop.
The file was actually a script, written in Visual Basic. A standard scan with McAfee will NOT pick this file up, because it has an odd extension, .VBS. This is not a binary, it's text, so removal is simple. One copy of the script is renamed RUNDLL.VBS and is stored in your \WINDOWS\SYSTEM or \WINNT\SYSTEM32 (on NT systems) folder. Removal is simple, just delete the file. The other copy of the file will reside in your TEMP directory, I.E. \WINDOWS\TEMP, which is where mine was. Note that the second copy will NOT be named RUNDLL, but will have the same extension of .VBS and is easily found and removed as no other file in that directory should have that extension.
HOW DO I KNOW I HAVE THE SCRIPT/VIRUS? A message will show up on your system, from me (not actually, from the script really) saying "Enjoy the links". It will have a file attachment, which is the afore mentioned file. CLICKING ON IT will LAUNCH the virus, and offer to put XXX links on your desktop. If this happened to you, you have the script/virus and need to follow the directions above (or below for you non-techies out there) and clean your system.
For the NON-TECHNICAL who get this message: READ ALL DIRECTIONS BEFORE PROCEEDING! IF YOU CAN'T FIGURE IT OUT, CALL ME FOR HELP!
Go and Download McAfee 4.0 from ftp.mcafee.com , http://www.mcafee.com/ or similar. Be sure you download the latest scan.dat file. Install McAfee, and then the latest scan.dat file. You may get an error telling you the file is locked! If so, you must restart your machine in MS-DOS mode, and manually copy the file scan.dat to the McAfee Directory. Be sure to write down where that is when you first install McAfee so you know where to copy the file to! You will also need either pkzip or WinZip (http://www.winzip.com/ ) to open the file the new dat files are in. Tell it so scan all files, and the script/virus if present will be deleted my McAfee. I have not tested any other scanners, but I'm sure if you have current files, you should be fine with Dr. Solomon, Norton, etc.
Again, I'm very sorry about this, and regret any inconvenience this may have caused.
Sincerely, Scott
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |