virus stuff (it does more than you think)

[Chris Tooley]

We are also running LDAP Directory Services for our E-mail Address Directory.  Some users who opened this sent it all people listed in the Directory.  However, it does not always use the LDAP listings.  It appears that if  you do not have a Personal
Address book it goes after other things.

Chris Tooley

Ryan Yagatich wrote:

> IF YOU'VE RECEIVED THE MESSAGE FROM TERRY, MILLER, AND RAN IT, YOU HAVE AN ILOVE YOU VIRUS.
>
> READ THIS
> ok, to remove the virus:
>
> delete from outlook.
>
> run registry editor by typing regedit at the run menu.
>
> goto "HKLM\Software\Microsoft\Windows\Current Version\Run" and delete the: MSKernel32.vbs link.
> then
> goto "HKLM\Software\Microsoft\Windows\Current Version\Run Services" and delete the: Win32DLL.vbs link
>
> right click on internet explorer, goto properties and change your homepage back the way it was.
>
> goto start, find *.vbs on ALL drives, it will over write ALL .mp3, .jpg, .jpeg, .mp2, .vbe, .vbs, .js, .jse, .css, .wsh, .sct, .hta with itself, and append .vbs to the end of it.
>
> then it will create a temporary web-page that will say "to view this document, please click on the button to view Active-X"
>
> if you have MIRC, it will modify your scripts, so when a person joins, except self, it will send that .htm document to the other people on the channel. so you want to remove them as well. yes, it does say that MIRC will never run again, but it's a lie.
>
> then it goes to outlook. finds all users on your outlook contact list, and sends itself to each user there with the subject in which you have seen.
>
> ryan