Regarding that stupid message that I just sent: I knew it was an email worm. In the progress of erasing it I must of hit enter, or double clicked on it. Maybe my mouse should be taken away from me..... When the attached file is executed, it will create the following two files: C:\WINDOWS\LINKS.VBS C:\WINDOWS\SYSTEM\RUNDLL.VBS It will also create a file called LINKS.VBS in the root of all network drives that are currently mapped. Next, the worm will modify the following registry to execute every time the machine boots up: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Run\Rundll=RUNDLL.VBS After infecting a system, it will displays a dialog box title "Free XXX links" with following content: This will add a shortcut to free XXX links on your desktop. Do you want to continue. If the user selects yes, it will create a shortcut pointing to an adult web site. It also searches for MIRC32.EXE and PIRCH98.EXE chat programs in C:\MIRC , C:\PIRCH98, C:\PROGRAM FILES and the sub directories of each of these directories. If it finds either of these programs, it will modify the corresponding SCRIPT.INI file or EVENTS.INI located in the same directory. These INI files will cause LINKS.VBS to be sent to other people during the IRC sessions.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:07:24 PDT