OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: New worm?
From: Jim Swanson (JimSOPTIMADIRECT.COM)
Date: Thu May 04 2000 - 09:24:32 CDT

We just got hit with the "I Love You" vbs virus. Only 4 people were
infected, but it infects about 10 different files AND the registry. Very
nasty. It then e-mails itself out to everyone on your distribution lists in
Outlook.

-----Original Message-----
From: Blue Boar [mailto:BlueBoarTHIEVCO.COM]
Sent: Thursday, May 04, 2000 10:07 AM
To: VULN-DEVSECURITYFOCUS.COM
Subject: New worm?

I received two copies of this worm-looking thing this morning. I don't
have time to look myself before I head out, but I thought the list
might be interested. The second copy looks like someone who got it
themselves and wants to know what it is.

Attached is a zip, and inside it is another zip of the two files
wrapped in their original mail headers.. so it should be pretty
safe unless you go out of your way to run them. In which case,
caveat subscriber.

It looks like VBScript, and has a .vbs extension, and diddles
with reg keys, so I assume it's after windows boxen with WSH
installed.

                                BB