Forum: Poser - OFFICIAL


Subject: <FONT SIZE=4>VIRUS ALERT !!! Please read carefully</FONT>

robert.sharkey opened this issue on May 04, 2000 ยท 16 posts


robert.sharkey posted Thu, 04 May 2000 at 12:49 PM

Attached Link: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=VBS_LOVELETTER-O

Theres a massive virus-attack in europe and asia, think it's only thing of thime for receiving usa. Short explanation what this virus does: 1. Came as a mail attachment named LOVE-LETTER-FOR-YOU.TXT.VBS , in this stage the only chance for your system to alive, !!!!!!! DELETE THIS MAIL !!!!!!!!!!!!! 2. After opening sends all your saved mailadresses the same mail 3. Goes to a homepage and loads a vb-script which corrupted many off your files to new virus-files 4. If you stay at the point of 4, it's to late. The only way is to reformat your disks. Virus-description: Subject: ILOVEYOU Text: Kindlz check attached loveletter from me Attachment: LOVE-LETTER-FOR-YOU.TXT.VBS Text from antivirus.com: risk rating: HIGH RISK Aliases: LOVELETTER Description: Note: This virus is currently in the wild and is spreading rapidly. This VBScript virus like Melissa uses Microsoft Outlook to send email with an attachment file ?LOVE-LETTER-FOR-YOU.TXT.vbs? to all email addresses listed in the address list. This email will have the subject: ?ILOVEYOU?, body: ?kindly check the attached LOVELETTER coming from me.? And a file attachment with the virus. LOVELETTER also propagates using mIRC by modifying the ?script.ini.? After connecting to a chat server using mIRC, the virus initiates a DCC send to all the users in the current channel and sends a copy of itself ?LOVE-LETTER-FOR-YOU.HTM?. This virus has a destructive payload, it overwrites files with specific extensions with its virus codes. This action eliminates the host file and what remains is the file containing the virus source code. Solution: (ONLY FOR EXPERIENCED USERS, mark from me) 1.Click START|RUN Type REGEDIT and hit ENTER key 2.In the left panel, click the "+" to the left of the following: HKEY_LOCAL_MACHINE Software Microsoft Windows CurrentVersion Run 3.In the right panel, search for the registry key that contains the data value of ?:WindowsSystem MSKernel32.vbs" and ?WIN-BUGSFIX.exe?. These are the registry keys that grant the capability to load the worm whenever Windows starts up. 4.In the right window, highlight the registry key that loads the file and press the DELETE key. Answer YES to delete the entry. 5.Search for the registry key that contains the data value of ?:WindowsSystem Win32DLL.vbs". This is the registry key that enables the worm to run each time Windows is started. 6.In the right window, highlight the registry key that loads the file and press the DELETE key. Answer YES to delete the entry. 7.Exit the registry. 8.Click START|SHUTDOWN. Choose "Restart in MS-DOS mode" and click OK. 9.After the computer has restarted, the default directory should C:. 10.Subsequently, type ?DEL WIN-BUGSFIX.exe?. 11.Press CTRL+ALT+DEL and allow Windows to restart. 12.You may also delete the file detected as VBS_LOVELETTER by Trend antivirus is to ensure re-infection does not occur. Technical details: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=VBS_LOVELETTER&VSect=T Sorry for posting this in this forum, but think it's really important. CHECK OUT THE LINK TO READ MORE. SHARKEY