ILOVEYOU version 2.0 ..
Luke Kenneth Casson Leighton
lkcl at samba.org
Fri May 19 19:02:51 GMT 2000
i cross-posted to NTBUGTRAQ, mike or anyone else if you think this does a
lot of damage [more than the virus itself] please say so, thx.
On Sat, 20 May 2000, Michael H. Warfield wrote:
> On Sat, May 20, 2000 at 01:02:01AM +1000, Peter Samuelson wrote:
> > Ho hum, another VBScript virus makes the rounds.
> > I just now looped through the output of a `smbclient -L PDC' with
> > something very like
> > for m in `cat /tmp/ntboxes`; do
> > rpcclient -S $m -U admin%pass -W mydomain -c \
> > 'regdeletekey "hkey_classes_root\.VBS"; quit'
> > done > /tmp/nomoreVBS.log 2>&1
> > Does that sound too drastic? Any better ideas? I am *really* getting
> > tired of this stuff.
> Not drastic enough... If you find one, raise hell... This one
> destroys systems by zeroing out all the files that it finds that are not
> in use.
> > *sigh*
> > Peter
> Michael H. Warfield | (770) 985-6132 | mhw at WittsEnd.com
> (The Mad Wizard) | (770) 331-2437 | http://www.wittsend.com/mhw/
> NIC whois: MHW9 | An optimist believes we live in the best of all
> PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
<a href=" mailto:lkcl at samba.org" > Luke Kenneth Casson Leighton </a>
<a href=" http://cb1.com/~lkcl" > Samba and Network Development </a>
<a href=" http://samba.org" > Samba Web site </a>
<a href=" http://mcp.com" > Macmillan Technical Publishing </a>
ISBN1578701503 DCE/RPC over SMB: Samba and Windows NT Domain Internals
More information about the samba-ntdom