 sj |
||
|
||
Tech: Despicable Virus Alert
|
|
|
Subject: Tech: Despicable Virus Alert From: Amos Date: 04 May 00 - 11:09 AM A current virus circulating the globe at high speed should be brought to your attention. It uses a Visual Basic script to mess with mail systems which speak that language such as MS Outlook. It comes as email with the subject "I Love you" and carries an attachment called ILOVEYOU.TXT.vbs. Do NOT open the attachment. Among other things, if you are using a vulnerable mail application, it will attach itself to 150 names from your address list and send itself to them. It has also been known to blank out all the user configuration setting in Netscape Communicator in one case. Mine. Just trash the email. it is despicable that some dweeb-psycho should use the most treasured message in our vocabulary to harm people's working environments this way. I spit. Blgggh. Be alert for it -- I have received two copies this morning appearing to come from company offices, and have heard it has spread as far as Asia.
Amos |
|
Subject: RE: Tech: Despicable Virus Alert From: Skivee Date: 04 May 00 - 11:28 AM I haven't gotten it myself, but two of my compu-palz have. This is the real thig here, not one of those knee jerk warning things. Thanks Amos |
|
Subject: RE: Tech: Despicable Virus Alert From: SINSULL Date: 04 May 00 - 11:35 AM Too Late, Amos. Someone at our office opened it. Monday my system crashed. Now this. Maybe by tomorrow I will be ready to write a song about it. right now I am ready to cry. |
|
Subject: RE: Tech: Despicable Virus Alert From: Amergin Date: 04 May 00 - 11:44 AM Thx for the warning, Amos. I'll keep an eye out for it. |
|
Subject: RE: Tech: Despicable Virus Alert From: SDShad Date: 04 May 00 - 11:49 AM Really, really, really don't open this evil abomination. Three people in our department did, and it's getting ugly. Not only does it send itself out to anyone in your Contacts and Personal Address Book, apparently if you're on a Microsoft Exchange server (which we are) it sends it out to everyone on the Exchange global address list. Even after cleaning it, one of our people still had 700 messages waiting to send in the Outbox. What's more, it infects all GIF, JPG, MP2, MP3, and .MPG files, and at least with our antivirus package, Command Antivirus, the only disinfect technique is to delete the infected file. And apparently, if goes out to a website where it downloads and runs another destructive program (which may be what actually messes with your multimedia files, I'm not sure). Melissa was nothing compared to the Love Bug. Avoid, avoid, avoid. Chris |
|
Subject: RE: Tech: Despicable Virus Alert From: Amergin Date: 04 May 00 - 12:05 PM I hope you don't mind, Amos, but I went ahead and pasted your post at another site, so to warn a few others. If you do mind I will be hanging my head down in shame. Amergin |
|
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 04 May 00 - 12:15 PM No, I don't mind. Good of all. Psychos like that deserve to be whipped with wet serial cables until they faint. It's not like we are all taking our leisure in all these offices around the land and have idel time on our hands. And bad days at the office often lead to bad days at home, for some folks, with family stresses and side-effects on kids, marriages, and so on. Not to mention the gross waste of bandwidth and the huge number of productive hours this little A-hole has decided to expropriate from the human treasury. Makes me angry. This is beyond the scope of normal compassion -- it calls for swift justice. And it probably won't happen because it is so hard to trace one of these flying viruses. This one even messes up the time-stamps on the relays in the headers (of the one I got) so it looked like it was running time backwards -- the originator timestamps were later than the receiver timestamps. Glad I'm not using a Microsoft mail product! |
|
Subject: RE: Tech: Despicable Virus Alert From: Llanfair Date: 04 May 00 - 12:16 PM It's been on the UK News today, it's causing mayhem. Bron. |
|
Subject: RE: Tech: Despicable Virus Alert From: Amergin Date: 04 May 00 - 12:21 PM Thanks, Amos, glad you don't mind. |
|
Subject: RE: Tech: Despicable Virus Alert From: katlaughing Date: 04 May 00 - 12:22 PM Thanks, Amos, I have copied and pasted you warning and sent it to everyone on my email list. I share in your outrage. |
|
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 04 May 00 - 12:24 PM The systems maintenance staff at Science Applications international, a large US engineering and science firm, have posted the following to their personnel nationwide: "E-Mail Virus Alert! SAIC E-Mail Services Currently Unavailable. All SAIC E-Mail services are currently unavailable due to a virus in the system. If you receive an e-mail message with the subject line "ILOVEYOU," delete it immediately without opening the message. E-Mail Services is working to resolve the problem as quickly as possible. Your patience is appreciated"
The virus goes into your address book and starts sending the message to everyone in your address books. There may also be a blue screen. A
|
|
Subject: RE: Tech: Despicable Virus Alert From: MMario Date: 04 May 00 - 12:25 PM Thanks amos....I just posted something myself as this wasn't appearing in my list. |
|
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 04 May 00 - 12:25 PM Norton Anti-Virus -- the Symantec Anti-Virus Research Center now has info on the virus posted on their Web page. Note that they call it LoveLetter.A http://www.sarc.com/avcenter/venc/data/vbs.loveletter.a.html Or click here for Norton's page. A |
|
Subject: RE: Tech: Despicable Virus Alert From: SINSULL Date: 04 May 00 - 12:42 PM We tried rebooting and it started all over again. Now our IT people are going through our entire system file by file. It's everywhere. Please if any of you find the person (generous term) who started this, don't kill him. I want him to suffer first. Maybe 3 weeks of Barry Manilow. We're fixed now. Back to work. |
|
Subject: RE: Tech: Despicable Virus Alert From: McGrath of Harlow Date: 04 May 00 - 12:57 PM There are three threads on this so far. The bloody thing is even duplicating (even triplicating) at second hand now...
Anyway, here's what I posted on one of the others:
Well, I can't imagine opening any message saying "I love you". It helps being a curmudgeon sometimes.
I make a point of deleting unread any attachments from peoplke I don't know and trust. But presumably if this love thing turns up iot'll be attached to some message allegedly from someone who's got you in their address book, and whom you know?
And presumably the same thing could be done with more plausible messages, such as "see attached song file" or whatever. So if anybody sends me any attachments, they are going to get back an email from me checking that its ok, and I expect other people to do the same to me. What a drag. |
|
Subject: RE: Tech: Despicable Virus Alert From: Molly Malone Date: 04 May 00 - 01:08 PM Yes, this file has hit the workplace here as well. It sends itself to your address list. We got the warning in plenty of time fortunately, but it looks like a harmless message from someone we do business with. Of course, someone in the office opens this and we ALL get it. That's why it's easy for people not to realize. If I got this from my hubby, of course I would open it! And of course I'm on his email list. So BEWARE! Workplaces everywhere are doubletiming to get rid of it. |
|
Subject: RE: Tech: Despicable Virus Alert From: Homeless Date: 04 May 00 - 01:29 PM We got hit with this today at our corporate office. I received 23 messages within 5 minutes. A couple things about this... IF YOU DON'T OPEN THE ATTACHMENT, your machine is not infected. If you do open the attachment, you will be infected and will need to do some serious fixing (at least on Win 95/98). The virus will look at the .jpg, .jpeg, .mpg, .mp3 and possibly other files on your drive and create new VBasic scripts with the same name. This is the manner in which it infects them. It does not actually change the files themselves. You need to delete all these .vbs files from you computer. In addition, there will be a WIN32DLL.VBS file created on your computer which needs deleted. Finally, there are a few places in the registry where keys get created to propogate this virus. All these new keys need deleted. If you are computer savvy, the keys can be found in any of the .vbs files - just open them with notepad. If you're not familiar with the registry, don't mess with it - get one of the anti-virus packages and hope it disinfects everything. |
|
Subject: RE: Tech: Despicable Virus Alert From: katlaughing Date: 04 May 00 - 01:30 PM Are any of you familiar with BrightMail? My ISP recommended it for sifting out spam, in fact I think they may be using it after a May 9th upgrade, as it is offered to ISP's, too. Apparently your email goes through their site filters first and anything suspect gets held in a cache for you to look at at your leisure, while all deemed worthy gets passed on to your mailbox. I would be interested except I'd like to know more about privacy and whether they gather info and use it to market or whatever. I have not explored their site, yet, so I don't know. Thanks, kat |
|
Subject: RE: Tech: Despicable Virus Alert From: SINSULL Date: 04 May 00 - 01:52 PM What I have learned the hard way: 1. My boss does not "Love" me. 2. Right click on any attachments and opt for a virus scan before opening them. It may not catch all but will most. 3. If above is necessary, don't open the GDThing! Mary Sunshine
|
|
Subject: RE: Tech: Despicable Virus Alert From: Dave (the ancient mariner) Date: 04 May 00 - 02:32 PM Thanks kat for the personal email; and Amos for warning us... Dave |
|
Subject: RE: Tech: Despicable Virus Alert From: Escamillo Date: 04 May 00 - 03:20 PM Thanks Amos, as far as Buenos Aires I received some alert message too, but until now there is still no damage. It's a good opportunity to REMIND EVERYBODY TO NEVER, NEVER OPEN AN ATTACHMENT IF YOU DID NOT SPECIFICALLY ASKED FOR IT. I´m sorry for any friends who may want to cheer me through messages like "hi", "see this", "listen to this" - I consider them in the same category as "earn money at the Web" and even "Virus alert" - I eliminate the message and the attachment without reading it. WE ARE REGISTERED IN MUCH MORE LISTS THAN WE CAN IMAGINE. See https://grc.com (Gibson Research Corp.) for a good explanation on how trojan programs work, and a program that will analyze your PC and give you more than one surprise, the program is OPTOUT. I have strong reasons to suspect that those trojans, introduced in your PC along with freeware programs, will CALL the headquarters of virus distributors and GIVE them your e-mail address, as well as they actually do to spammers. Beware. Un abrazo - Andrés
|
|
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 04 May 00 - 08:56 PM I thought those of you who have watched this catastrophe unfold in our global underbelly might like to see what the first part of the file that caused all this looked like. I found it tucked away in a plug-ins directory. But it seems very certain this is the code that was plundering the time of hard working people all over the planet, and as you can see it seems to have been written by a person who is constrained to go to school. In other words another of the antisocial juvenile class which we have all come to know and ... love: FILE EXCERPT STARTS HERE===== rem barok -loveletter(vbe) <i hate go to school> A. |
|
Subject: RE: Tech: Despicable Virus Alert From: Mrrzy Date: 04 May 00 - 10:00 PM Wow! I always complain about our IT dept, but we got this virus and DIDN'T crash or lose email (and, we have Asian and European offices) - I take back all the awful things I said about them! Consider it all transferred to the perps... |
|
Subject: RE: Tech: Despicable Virus Alert From: Billy the Bus Date: 04 May 00 - 11:58 PM It was "top of the 6am news", here in NZ. Seems quite a few businesses have been affacted. No signs of it in my mail box yet - TG. Thanx for the warning and tips. Sam |
|
Subject: RE: Tech: Despicable Virus Alert From: MK Date: 05 May 00 - 01:35 AM Amos, you're a man after my heart (in a Padres sort of way.) I love reading source code, and much of the time I spend surfing, I find reading the source code of a given web page more entertaining than the content and design of the web page itself. Does this make me a ---------------nerd? *BG* |
|
Subject: RE: Tech: Despicable Virus Alert From: Bob Bolton Date: 05 May 00 - 01:54 AM G'day all, I don't know if this is an Australian-only variant (if it is, it won't stay that way for long!) but Helen has (on the other version of this thread) raised what I came in for. There is a new variant, using the same basic Visual Basic Script but now headed FWD: JOKE with a text very like; "You will find this very funny." and an attached file "VERYFUNNY.TXT.vbs". nyone who works in a large organisation - or who has a wide circle of friends with a sense of humour - will find this particularly insidious! Regards, Bob Bolton |
|
Subject: RE: Tech: Despicable Virus Alert From: Helen Date: 05 May 00 - 02:16 AM Thanks Bob, Here is the web address, via Go.Com for the JOKE variant on the ILOVEYOU virus. http://www.abcnews.go.com/cgi/transfer.pl?goto=http://www.abcnews.go.com/sections/tech/DailyNews/virus_000505.html&name=fromgonews Helen
|
|
Subject: RE: Tech: Despicable Virus Alert From: Escamillo Date: 05 May 00 - 05:36 AM Once you have made a succesful virus, and have the world at your feet (as those jerks may feel), it´s very easy to start new ones with different names and different legends to hook the curiosity of people. Again, destroy those mails as soon as you see them. Don´t even try to reply to the sender. Don´t open unsolicited attachments coming from your mother. Sure it is not a sweater. Un abrazo - Andrés |
|
Subject: RE: Tech: Despicable Virus Alert From: Crowhugger Date: 05 May 00 - 06:39 AM Oh, why didn't I look at this thread when I saw it yesterday? I'm now awaiting a reply from my Aunt as to whether she e-mailed me. I [expletive withheld] hope so. CH. |
|
Subject: RE: Tech: Despicable Virus Alert From: GeorgeH Date: 05 May 00 - 07:53 AM Actually, I find this thing has given me more laughs than anything I can remember. If you use a sensible email agent then you won't propagate this virus. If you use a sensible computer operating system (Mac or Unix these days, I suppose) you're completely immune from it. If you follow the standard, sensible rules for configuring your system and dealing with received email you won't have been affected by this at all (ok, it's propagation is clever so that if you're hit by a "second wave" copy of it it will appear to have been sent by someone you know). So its shutting down Government email systems just shows how inadequate their IT provision/training is. And if you don't like it - complain to Bill Gates for supplying the world with such stupid tools. If ever you wanted proof that MS's dominance of the desktop computer market is unhealthy then this is it. BTW it could have been MUCH worse - the distribution of the thing could have used randomly-changed subject lines, and/or the REAL nasty virus could have been installed on a web server which was able to cope with all the "hits" it received. No, I don't approve of viruses. But I disapprove even more of MS making it almost trivial to distribute them (there are, literally, hundreds of thousands of IT people out there who could have written the distribution side of this thing . . ) Sorry if this offends anyone out there, but these truths need expressing. (And yes, we received copies of the virus, and no, we weren't affected by it . .) G. |
|
Subject: RE: Tech: Despicable Virus Alert From: MMario Date: 05 May 00 - 09:18 AM There are literally hundreds of thousands of SCHOOL CHILDREN who could havewritten this.... |
|
Subject: RE: Tech: Despicable Virus Alert From: Dave (the ancient mariner) Date: 05 May 00 - 09:28 AM The potential to destroy hospitals, Search and Rescue services, and humanitarian agencies by this type of virus is truly frightening. We are so dependant on technology to support our operations that it would place many lives in danger. People who are caught writing such programs should be charged with attempted murder in my opinion. Yours, Aye. Dave |
|
Subject: RE: Tech: Despicable Virus Alert From: Crowhugger Date: 05 May 00 - 10:14 AM Dtam, that's a good idea, convicted too. GeorgeH, too-true truths. I think whichever OS is most widely used would be most vulnerable. Also Norton, McAfee et al profit nicely from this stuff. If this virus is new, how long till upgrades can remove it? Whew, after my first worst thoughts, I realized that the magic words weren't in the subject line of the e-mail from my Aunt. CH. |
|
Subject: RE: Tech: Despicable Virus Alert From: jeffp Date: 05 May 00 - 10:21 AM A co-worker alerted us to a new variant on the Love Bug virus. It comes in an email which claims to be a Mother's Day order confirmation. It says that $350 has been billed to your credit card and an invoice is attached. The invoice is the virus. Beware! jeffp |
|
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 05 May 00 - 10:40 AM George, I suppose any of can get caught by a virus at sometime but it is true that a few sensible precautions dramatically reduce the risk and I think that is something that has been mentioned here a few times. Your thoughts on MS and how easy they have made it are interesting. I must admit having seen a code sample yesterday, I wondered about the same thing. It appeared to me that anyone with the slightest knowledge of VB (or any high level language) and the relevant documentation could write such a program. Jon |
|
Subject: RE: Tech: Despicable Virus Alert From: MMario Date: 05 May 00 - 12:32 PM you should have seen the snit-fit I threw in a bookstore one day when I walked in and there, sitting on a prominent showcase display for sale was "Viruses for Dummies - how to create and distribute them"! I went through the roof! I did the whole red-faced screaming yelling "I demand to see the manager, NOW!" bit with quite a few people around....(and was mortified later....) I wish I could say they immedietly removed the book from the stands, but they didn't. However, the next day it was in the back of the store.... |
|
Subject: RE: Tech: Despicable Virus Alert From: Sorcha Date: 05 May 00 - 12:41 PM Sent a message to my brother, who is in the US Army and e mails me from his office computer----he said the Army is in a PANIC about this.............he had rec'd it, but didn't open it, thank goodness, so it's not his fault if the Army crashes! |
|
Subject: RE: Tech: Despicable Virus Alert From: Amergin Date: 05 May 00 - 12:51 PM Just read that they may have traced it to a 23 year old male in the Phillippines. |
|
Subject: RE: Tech: Despicable Virus Alert From: GUEST,Fionn Date: 05 May 00 - 01:57 PM Thank God for GeorgeH. Was beginning to think we'd all lost our sense of fun! But why don't you all ditch Windows and use Linux, which is free and freely downloadable (or maybe 50 bucks if you want it on CDs with manuals etc), and many times more powerful and many times more robust/reliable than Windows? If you think I'm joking, just find someone who uses it and see what they say. In the meantime you'll all have to go and vent your bile on that 23-year-old nerd in Manila. |
|
Subject: RE: Tech: Despicable Virus Alert From: catspaw49 Date: 05 May 00 - 02:08 PM MARIO.......You've got to be shitting me! Tha's really a book??? Really? Did you look at it? What was in it? Spaw |
|
Subject: RE: Tech: Despicable Virus Alert From: SDShad Date: 05 May 00 - 02:21 PM Depends, Fionn. Does Hearme work under Linux? Chris |
|
Subject: RE: Tech: Despicable Virus Alert From: GeorgeH Date: 05 May 00 - 02:22 PM I'm sorry DaveAM, but there is NO excuse for hospitals etc being brought to their knees by that OTHER than utter incompetence in their management . . no comfort to those put at risk by the result of the virus (which is why I don't defend IN ANY WAY the action of the originator of this thing) - but I do think those responsible for "managing" these "services" show an even greater failure . . The point is that this attack mechanism was both obvious and well known. Only through complacency (or total incompetence) could this have had the impact it did. G. |
|
Subject: RE: Tech: Despicable Virus Alert From: SeanM Date: 05 May 00 - 02:30 PM Well, one unfortunate side effect of Microshaft's market dominance is the utter lack of Linux based products. I've seen a couple places that offer Linux software for download, but nothing out in the open market. Until that is changed, Linux will continue to be primarily a business/techwonk OS, without any impact on the average consumer computer user. M |
|
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 05 May 00 - 02:48 PM New angles on the aftershocks:
Mother's Day Worm Worse? (Technology 8:00 a.m. PDT) http://www.wired.com/news/technology/0,1282,36152,00.html?tw=wn20000505
At least five variants of Thursday's virulent 'Love Bug' email worm have already be found. A 'Mother's Day' worm can cripple a user's computer. By Michelle Finley. Hey Spyder: Love You, Too (Technology 3:00 a.m. PDT)
http://www.wired.com/news/technology/0,1282,36139,00.html?tw=wn20000505 The Love Continues to Spread (Technology 7:00 a.m. PDT)
http://www.wired.com/news/technology/0,1282,36149,00.html?tw=wn20000505 The 'Love Bug' is now being called the worst computer worm ever, and it continues to spread all over the world. Copycats abound, too.
Vendors Overwhelmed by 'Love' (Technology 3:00 a.m. PDT)
http://www.wired.com/news/technology/0,1282,36128,00.html?tw=wn20000505
|
|
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 05 May 00 - 03:03 PM And finally some directions on fixing the damage caused by the LoveLetter from Spyder. |
|
Subject: RE: Tech: Despicable Virus Alert From: MMario Date: 05 May 00 - 03:39 PM yes, 'spaw, there is indeed such a book, and it has detailed step by step instructions on how to write a virus, worm, trojan , and just about every other nasty you can think of. And how to distribute them. I respect the author's right under freedom of speech to write the book, however I do wish that the publisher had declined to print it and the store declined to carry it. |
|
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 05 May 00 - 03:57 PM Re the Linux thought, I have tried running Corel Linux in a DOS folder and have found it less than satisfactory. I would like to pursue using Linux but feel I will need to be in a position where I am able to give it it's own partition or ideally disk drive before I can really see what it is like. The problem here is basically that for better or worse, I know what I have under Windows and much of it works reasonably well and it would take me months (assuming I could) to make the move and find equivilant programs assuiming I could afford to. I support the Linux move but I feel that it is impractical for many of us and regards to this forum and things I have been involved with, can not get the Java ICQ to run and hearme do not suport Hearme. I am not into the MS dominance but until I have something better that what I have now I would not be suggesting that Windows users abandon it in favour of Linux. Jon |
|
Subject: RE: Tech: Despicable Virus Alert From: Chocolate Pi Date: 05 May 00 - 04:24 PM I'm using LinuxPPC, doublebooting with MacOS, on an iMac. I love my Linux box very much (the OS takes up hardly any room (so I can play Quake3!); code compiles screamingly fast); however, I wouldn't reccomend it for people who want their machines to be a black box (or beige box). You do have to learn about what's really going on, instead of just pointing and clicking. There aren't ports of many popular software apps, although there's all kinds of stuff showing up on Freshmeat all the time. I suppose it is possible to run Linux as a user from an Xwindows GUI without ever having to go into command-line, but that takes all the fun out of it! Chocolate Pi |
|
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 05 May 00 - 05:30 PM I guess part of the problems I had with Corel Linux were that I couldn't get to the command line. The only way I could set it up involved running in a Dos folder, the Dos Loader started and I could find no way of interupting the process without comlete lock up until the KDE display manager loaded. I had changed a grahics card and all I could get was a flashing screen even in command prompt mode (Ctr Alt F2 takes you there from the grahics from KDE). To make matters worse, the only time the keyboard input was accepted was when the screen was "on" in its flash mode. Took me ages keying in to get to XF86Config to set it back to a std VGA monitor before I was able to tell it about the ATI card... I am still persevering with Linux and think that some of my troubles were to do with the DOS loader but things need to improve on this sort of thing. Jon (never a Unix user but a CP/M and DOS command line user) |
|
Subject: RE: Tech: Despicable Virus Alert From: McGrath of Harlow Date: 05 May 00 - 07:32 PM I juast checked Amzon for "Viruses for Dummies" - I didn't find it - but there was "Virus Defence for Dummies". Out of print.
Still I suppose, if you're in the business of writing viruses, you would need to know about defence techniques, so maybe there's not a lot of difference. Lke when a government is running germ or poison gas warfare research, this always gets explained as being intended purely to help defened against germ or poison gas attacks.
Basic rule is, any time you get an attachment you haven't asked for, send an email saying "there's an email in my intray which says it's from you, with an attachment called etc etc - could you confirm that it's what it says it is?" What's difficult about that? And the other thibg kjs, once you've deleted any suspicious emails and attachments, empty the deleted file as well, just to be on the safe side.)
The thing has its funny side though - the British House of Commons got hit because some MP saw the ILOVEYOU attachment, and thought it was real and opened it. Now what kind of politician would expect to get a real "I Love You" message? (Well, Ken Livingstone might maybe, but he'd not be fool enough to trust it and open it.) |
| Share Thread: |