ILOVEYOU version 2.0 ..

[Luke Kenneth Casson Leighton]

i cross-posted to NTBUGTRAQ, mike or anyone else if you think this does a
lot of damage [more than the virus itself] please say so, thx.

On Sat, 20 May 2000, Michael H. Warfield wrote:

> On Sat, May 20, 2000 at 01:02:01AM +1000, Peter Samuelson wrote:
> 
> > Ho hum, another VBScript virus makes the rounds.
> 
> > I just now looped through the output of a `smbclient -L PDC' with
> > something very like
> 
> >   for m in `cat /tmp/ntboxes`; do
> >     rpcclient -S $m -U admin%pass -W mydomain -c \
> >       'regdeletekey "hkey_classes_root\.VBS"; quit'
> >   done > /tmp/nomoreVBS.log 2>&1
> 
> > Does that sound too drastic?  Any better ideas?  I am *really* getting
> > tired of this stuff.
> 
> 	Not drastic enough...  If you find one, raise hell...  This one
> destroys systems by zeroing out all the files that it finds that are not
> in use.
> 
> > *sigh*
> 
> > Peter
> 
> 	Mike
> -- 
>  Michael H. Warfield    |  (770) 985-6132   |  mhw at WittsEnd.com
>   (The Mad Wizard)      |  (770) 331-2437   |  http://www.wittsend.com/mhw/
>   NIC whois:  MHW9      |  An optimist believes we live in the best of all
>  PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!
> 

<a href=" mailto:lkcl at samba.org" > Luke Kenneth Casson Leighton    </a>
<a href=" http://cb1.com/~lkcl"  > Samba and Network Development   </a>
<a href=" http://samba.org"      > Samba Web site                  </a>
<a href=" http://mcp.com"        > Macmillan Technical Publishing  </a>
 
ISBN1578701503 DCE/RPC over SMB: Samba and Windows NT Domain Internals