I looked at the source code for this thing and it looks to be weakly coded.
Odds are it won't be sending from everyone's address book and i didn't
notice any way it could send from people who use anything other than Outlook
Express. It looks like it changes your homepage, i would assume launch a
browser so it goes to that homepage, download a file from a website, then do
something with that... There is only one problem, the dolts put that
essential ingredient on fortunecity.com, a free webhoster! The site is down,
surely very shortly after someone noticed their URL in the virus! i'm not
sure but there could still be some ill effects, the worst of which would be
a lost internet connection. I couldn't tell you what it could do if it were
able to download the file.
If you know how to edit your registry you can probably fix this guy yourself
if you haven't rebooted (or maybe if you did even). There are several
registry keys listed that it's adding if you dig through the code and you
can check to see if you got em in your reg. Removing those should stop the
virus or negate some of it's effects (if there are any). DO NOT ASK ME HOW
TO DO THIS. It would be nigh-impossible to explain in lay the steps
required.
Sean Bruckman
----- Original Message -----
From: Rob Parenti <rparenti@bellsouth.net>
To: <dakota-truck@buffnet.net>
Sent: Wednesday, September 20, 2000 3:19 PM
Subject: DML: WARNING - POSSIBLE VIRUS!!!! = RE: US PRESIDENT AND FBI
SECRETS =PLEASE VISIT => (http://WWW.2600.COM)<=
> DON'T OPEN THIS ATTACHMENT! POSSIBLE VIRUS! (Yes - I am yelling!)
>
> The file name is HMOOULE.JPG.vbs. This is the way the "I Love You" virus
> works, by camouflaging a Visual Basic virus script as a JPG file.
>
> - Rob
>
> -----Original Message-----
> From: owner-dakota-truck@buffnet.net
> [mailto:owner-dakota-truck@buffnet.net]On Behalf Of Neal Arita
> Sent: Wednesday, September 20, 2000 3:11 PM
> To: 'Dakota Mailing List'
> Subject: DML: US PRESIDENT AND FBI SECRETS =PLEASE VISIT =>
> (http://WWW.2600.COM)<=
>
>
This archive was generated by hypermail 2b29 : Fri Jun 20 2003 - 11:54:41 EDT