I use a script called Demime to strip specific things out of emails for my
mailing lists. One of the things it never misses is any attachment with a
vbs extension. If anyone is interested, and I hope those responsible for
this list are ;-), you can get it at:
http://scifi.squawk.com/demime.html
Ed
At 09:41 AM Wednesday, 5/9/2001, Devon Null wrote -=>
>At 07:59 05/09/2001 -0400, Dorian_750 wrote:
> >Hi!
> >You've got to see this page! It's really cool ;O)
> >Attachment Converted: "C:\applications\EudoraPro\Attach\homepage.HTML3.vbs"
>===========================================
>
>Re: [newbie] Homepage [ALERT] Virus alert...
>
>VBSWG.X (also known as VBS.VBSWG.X and VBS.Homepage)
><http://www.cai.com/virusinfo/encyclopedia/descriptions/vbsvbswgx.htm>
>
>VBSWG.X is a worm spreading via the Internet e-mail system and is yet
>another variant generated by the VBS Worm Generator Kit.
>
>The worm arrives as a message with the Subject line:
>
>"Homepage"
>
>and the message body:
>
>"Hi!
>You've got to see this page! It's really cool ;O)"
>
>The attached file, which contains the worm code is named:
>
>"HOMEPAGE.HTML.VBS"
>
>When the attached code is executed, VBSWG.X saves a copy of its code to the
>Temp directory and then mails itself out to all recipients listed in all
>address books.
>
>Once the mailing procedure is completed the worm modifies the registry
>entry (sets it to 1):
>
>HKEY_CURRENT_USER\Software\An\mailed
>
>Next, the worm browses through the Inbox and Deleted Outlook folders and
>deletes all messages with the same Subject line as the worm's one
>("Homepage").
>
>Finally, VBSWG.X uses a default Web browser to open one of the following
>pages:
>
>"http://hardcore.pornbillboard.net/shannon/1.htm";
>"http://members.nbci.com/_XMCM/prinzje/1.htm";
>"http://www2.sexcropolis.com/amateur/sheila/1.htm";
>"http://sheila.issexy.tv/1.htm";
>|-=-=-=-=-=-=-=-=-=-=-<-30->-=-=-=-=-=-=-=-=-=-=-|
Ed Kasky
Los Angeles, CA
. . . . . . . .
The grass is always greener when you leave the sprinkler on.
