Lots of people replied this is a worm/virus/trojan called VBS.Freelink. For more information: http://www.sarc.com/avcenter/venc/data/vbs.freelink.html http://www.symantec.com/region/uk/avcenter/venc/vbs_freelink.html http://vil.mcafee.com/vil/vbs10225.asp http://www.DataFellows.com/v-descs/freelink.htm http://www.trend.com/vinfo/virusencyclo/default5.asp?VName=VBS_FREELINK. http://vil.nai.com/villib/alpha.asp http://vil.nai.com/vil/vbs10225.asp Decrypted versions of links.vbs and rundll.vbs: http://www.tirsek.dk/bugtraq/links_vbs.txt http://www.tirsek.dk/bugtraq/rundll_vbs.txt Highlights: * The worm spread via email, IRC if it can find mIRC and by copying itself to network drives. * Its not new, but it has spread wide recently. * Most scanner are not configured to look for .VBS files by default. You must tell your scanner to look for them. Thanks: Norbert Luckhardt <nlat_private> Eric Chien <ecchienat_private> Peter Tirsek <peterat_private> Pollard, Bette <PollardBat_private> Rodefeld, Sonja <Sonja.Rodefeldat_private> Jaapar, Jazzery <JJaaparat_private> Christopher P. Lindsey <lindseyat_private> AMackenzieat_private Dennis Dow <ddowat_private> Tim Sole <timsat_private> Dan Schrader <Dan_Schraderat_private> -- Elias Levy Security Focus http://www.securityfocus.com/
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:08:00 PDT