Hello to EVERYONE in my address book:
Yesterday I was hit by a "virus" that may have replicated and mailed itself to
everyone in my address book. I'm very sorry about this. I didn't send this
out right away, because I wanted to know what to do about it FIRST. With that
in mind, here's the scoop.
The file was actually a script, written in Visual Basic. A standard scan with
McAfee will NOT pick this file up, because it has an odd extension, .VBS.
This is not a binary, it's text, so removal is simple. One copy of the script
is renamed RUNDLL.VBS and is stored in your \WINDOWS\SYSTEM or \WINNT\SYSTEM32
(on NT systems) folder. Removal is simple, just delete the file. The other
copy of the file will reside in your TEMP directory, I.E. \WINDOWS\TEMP, which
is where mine was. Note that the second copy will NOT be named RUNDLL, but
will have the same extension of .VBS and is easily found and removed as no
other file in that directory should have that extension.
HOW DO I KNOW I HAVE THE SCRIPT/VIRUS?
A message will show up on your system, from me (not actually, from the script
really) saying "Enjoy the links". It will have a file attachment, which is
the afore mentioned file. CLICKING ON IT will LAUNCH the virus, and offer to
put XXX links on your desktop. If this happened to you, you have the
script/virus and need to follow the directions above (or below for you
non-techies out there) and clean your system.
For the NON-TECHNICAL who get this message:
READ ALL DIRECTIONS BEFORE PROCEEDING! IF YOU CAN'T FIGURE IT OUT, CALL ME
FOR HELP!
Go and Download McAfee 4.0 from ftp.mcafee.com , http://www.mcafee.com/ or
similar. Be sure you download the latest scan.dat file. Install McAfee, and
then the latest scan.dat file. You may get an error telling you the file is
locked! If so, you must restart your machine in MS-DOS mode, and manually
copy the file scan.dat to the McAfee Directory. Be sure to write down where
that is when you first install McAfee so you know where to copy the file to!
You will also need either pkzip or WinZip (http://www.winzip.com/ ) to open
the file the new dat files are in. Tell it so scan all files, and the
script/virus if present will be deleted my McAfee. I have not tested any
other scanners, but I'm sure if you have current files, you should be fine
with Dr. Solomon, Norton, etc.
Again, I'm very sorry about this, and regret any inconvenience this may have
caused.
Sincerely,
Scott
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Mon Feb 07 2000 - 21:00:09 EST