I was able to decrypt the script. It makes a registry entry at
HKey_Current_User\Software\OnTheFly, and on Jan 26 it sends you so
www.dynabyte.nl. I went there on my Linux box, and there doesn't seem to be
anything sinister there. Some days, I really hate email...
Mike Welch (TurboPower Software)
-----Original Message-----
From: flinters [mailto:flinters@picarefy.com]
Sent: Monday, February 12, 2001 12:34 PM
To: Spitfire List
Subject: That silly virus
It's a new one, and typical of most VBS (Visual Basic
Script) viruses. Once opened, it will use your address book in
Outlook/Outlook Express to email copies of itself to others. It's unclear
if this is a clone of the I LOVE YOU version but the distribution is the
same. There is no 'payload' or damage done to your system by this virus
other than to your email program. This is a new virus- it's hitting the
Net at about the same time- 9 AM PST. I've gotten copies of the message
from several lists, personal email, and corporate email, all through
separate channels but all all started at about the same time.
There is no need to blame or try to trace the source- it's already too far
widespread. But you can prevent its spread by simply deleting any message
with the "Here you have,;o" subject line.
For more information:
http://news.cnet.com/news/0-1003-200-4792664.html?tag=mn_hd
--
*********************************************************************
* *
* Flinthoof Ponypal *
* Vegaman Dan *
* *
* http://jarmac.picarefy.com Ponypics! *
* http://jarmac.picarefy.com/spitfire 1968 Triumph Spitfire *
* http://jarmac.picarefy.com/roomies Roomies! online comic strip *
* *
*********************************************************************
|