Just thought you'd better know...
you've been infected with a vb script virus, and this caused your mail
client to send a mail to the jsp-interest mail group hosted by Sun. The
alert and description from our Systems Manager are listed below:
Sun - can you deal with this please? Need to remove the email from the
list archive at least, and if possible block any more with the subject
"Check this" coming through the listerv address?
Hope this stops people getting done by this virus...
Jari Worsley
Hyperlink
===================
All,
Yet another virus has been received by the company. Please read the
description of the virus below. Should your PC become infected with this
or
any other virus please call systems immediately.
Name: VBS/FreeLinks
Aliases: VBS/Freelink, VBS.Freelinks, VBS.Freelink, Freelink/VBS
Type: Visual Basic Script worm
Resident: No
Comments: This virus is an encrypted VB Script virus that spreads itself
by
e-mail, network drive sharing and IRC client scripting abilities. The
virus
spreads as an e-mail message with subject "Check this". The message text
is
"Have fun with this cool links", and the message attachment is the
actual
virus.
If the attached VBS script (LINKS.VBS) is run, it displays a message
"This
will add a shortcut to free XXX links on your desktop. Do you want to
continue ?".
If the answer is yes the virus creates a .URL file that contains a link
to
an adult website.
The virus makes changes to the Windows registry so
C:\WINDOWS\SYSTEM\RUNDLL.VBS is run every time the infected computer is
rebooted. The RUNDLL.VBS file checks if there are mIRC or PIRCH IRC
clients
installed and if any of these are, the virus creates a SCRIPT.INI or
EVENTS.INI file which sends the virus to other users on the same IRC
channel
on a JOIN channel event.
If there is a shared network disk drive, the virus will copy itself to
the
drive and therefore spread through a network. The virus attempts to
create
and send the above e-mail message to all entries in the user's Outlook
address book.
Regards
Nick.
Nick Folkes E: [EMAIL PROTECTED]
Systems Manager T: +44 20 7240 8121
Hyperlink Plc F: +44 20 7240 8098
M: 07747 604730
===========================================================================
To unsubscribe: mailto [EMAIL PROTECTED] with body: "signoff JSP-INTEREST".
FAQs on JSP can be found at:
http://java.sun.com/products/jsp/faq.html
http://www.esperanto.org.nz/jsp/jspfaq.html
