Re: Post from 2003-11-07 20:18 contains virus in attached file.

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 11/11/03 

Date: Mon, 10 Nov 2003 22:13:49 -0500

Yes...

There was no payload in the script. Read it. It purports to what it can NOT do because
there is no code to do it !

It's a Fake Out !

Here is one of my favourite Fake Outs. Use IE and go to the following URL:
http://fun.tmc.dyn.ee/reboot.html

Dave

"Gunilla" <Gun@yahoo.com> wrote in message news:eLBv7CAqDHA.3688@TK2MSFTNGP11.phx.gbl...
| Hi David.
|
| Regarding my ZA's log it says "Renamed email attachment help.vbs to
| help.zlv" but do you mean that this was a false positive?
|
| Gunilla.
|
| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
| news:ex2WS3$pDHA.2964@tk2msftngp13.phx.gbl...
| > Yeah that was a post made by Ricky (abuse@bt.net) and we have been
| bitching about the DOZENS
| > of infectors he has posted over the last 4 or so days.
| >
| >
| > Many of the posts made that day were deleted from the News server so I
| don't have the exact
| > infector.
| >
| > The only one I have is HELP.VBS and it is not a virus but a fake-out....
| > --------------
| > ' This is a very simple example of what you can create with Vscript, You
| only need to save
| > your script in .vbs format.
| > ' Contact me
| > MsgBox("HI, how you doing? Ham just wants to perform a clean registery
| set up for you now")
| > MsgBox(" DO NOT WORRY, I just delete all registery keys, then you can
| install a clean XP on
| > you computer, OK?")
| > MsgBox("Deleting Registery is almost completed, now reboot your computer
| and work in a
| > non-Win invironment...haha! ;)")
| > MsgBox(" H A V E A N I C E H O L I D A Y !
| >
| ////////////////////////////////////////////////////////////////////////////
| ////////////////
| > ///////////////////////////////////////////////////")
| > Dim Shell
| > Set Shell= WScript.CreateObject("WScript.Shell")
| > Shell.Run("msimn.exe")
| > --------------
| >
| > Dave
| >
| >
| >
| >
| > "Gunilla" <Gun@yahoo.com> wrote in message
| news:%23ZFAst$pDHA.2804@TK2MSFTNGP09.phx.gbl...
| > | Okay Bill...I am sorry for not thinking about that earlier. I am just so
| > | silly to forgot that I should not allowing attachments to be opened.
| This
| > | just came without me open the attachment.
| > |
| > | It is just a simple "hi" as a subject and started by a SAIRABANO AT
| > | HOTMAIL.COM followed by Jason and then this "?" person and then He's
| Baaack.
| > | YoKenny posted a AVG update Oct.31st just below the OP .
| > |
| > | Hope this helps a little.
| > |
| > | Gunilla.
| > |
| > | "Bill Sanderson" <Bill_Sanderson@msn.com.plugh.org> wrote in message
| > | news:OVPuug$pDHA.1324@TK2MSFTNGP09.phx.gbl...
| > | > Clue me into the thread subject please--I can't find it with just
| those
| > | > items, I'm afraid.
| > | >
| > | >
| > | > "Gunilla" <Gun@yahoo.com> wrote in message
| > | > news:egzHsK$pDHA.2808@TK2MSFTNGP10.phx.gbl...
| > | > > Okay...did a big mistake while reading the posts. Normally I am
| reading
| > | a
| > | > > post, closing it down and then opening a new one but this time I
| just
| > | > pushed
| > | > > the "next" button in the toolbar and accidently opened the post with
| the
| > | > > attachment.
| > | > >
| > | > > However...to my big luck..Zone Alarm caught it, renamed it and put
| it
| > | into
| > | > > quarantine. Just thought I wanted to let you know that there is
| still a
| > | > post
| > | > > with virus in this NG.
| > | > >
| > | > > Regards / Gunilla.
| > | > >
| > | > >
| > | > > ---
| > | > > Outgoing mail is certified Virus Free.
| > | > > Checked by AVG anti-virus system (http://www.grisoft.com).
| > | > > Version: 6.0.537 / Virus Database: 332 - Release Date: 2003-11-07
| > | > >
| > | > >
| > | >
| > | >
| > |
| > |
| > | ---
| > | Outgoing mail is certified Virus Free.
| > | Checked by AVG anti-virus system (http://www.grisoft.com).
| > | Version: 6.0.537 / Virus Database: 332 - Release Date: 2003-11-07
| > |
| > |
| >
| >
|
|
| ---
| Outgoing mail is certified Virus Free.
| Checked by AVG anti-virus system (http://www.grisoft.com).
| Version: 6.0.537 / Virus Database: 332 - Release Date: 2003-11-07
|
|

Relevant Pages

  • Re: Post from 2003-11-07 20:18 contains virus in attached file.
    ... of infectors he has posted over the last 4 or so days. ... MsgBox(" DO NOT WORRY, I just delete all registery keys, then you can install a clean XP on ... |>> Outgoing mail is certified Virus Free. ...
    (microsoft.public.security.virus)
  • Re: Post from 2003-11-07 20:18 contains virus in attached file.
    ... Ham just wants to perform a clean registery ... > | Gunilla. ... > | Outgoing mail is certified Virus Free. ...
    (microsoft.public.security.virus)
  • Re: Help on script
    ... > Try this I would email the script to you, but being you dont know me you ... >> but the drives are mapped up. ... > Outgoing mail is certified Virus Free. ...
    (microsoft.public.windows.server.sbs)
  • Re: changing NT passwords across the Internet using SSL
    ... the password, but you still need a script, probably an ADSI script, to ... search www.google.com or www.microsoft.com/support for "ADSI ... Outgoing mail is certified Virus Free. ...
    (microsoft.public.inetserver.iis.security)
  • Assistance for product ids
    ... i need a script to enable me to list the product ids of installed ... Outgoing mail is certified Virus Free. ...
    (microsoft.public.scripting.wsh)