ILOVEYOU version 2.0 ..
Michael H. Warfield
mhw at wittsend.com
Fri May 19 14:24:14 GMT 2000
On Sat, May 20, 2000 at 01:02:01AM +1000, Peter Samuelson wrote:
> Ho hum, another VBScript virus makes the rounds.
> I just now looped through the output of a `smbclient -L PDC' with
> something very like
> for m in `cat /tmp/ntboxes`; do
> rpcclient -S $m -U admin%pass -W mydomain -c \
> 'regdeletekey "hkey_classes_root\.VBS"; quit'
> done > /tmp/nomoreVBS.log 2>&1
> Does that sound too drastic? Any better ideas? I am *really* getting
> tired of this stuff.
Not drastic enough... If you find one, raise hell... This one
destroys systems by zeroing out all the files that it finds that are not
Michael H. Warfield | (770) 985-6132 | mhw at WittsEnd.com
(The Mad Wizard) | (770) 331-2437 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
More information about the samba-ntdom