Results 1 to 14 of 14

Thread: What do I do about this?

  1. Jul 6th, 2001, 02:18 PM #1
    denniswrenn
    Guest

    What do I do about this?

    I recieved an email with a VBS attachment, which looked innocent...

    Code:
    Execute DeCode(Long string with a bunch of crap)
    but when I copied the decode function into VB and decoded the string, I found a nasty little worm

    What do I do about this? Who do I report this to?
    Reply With Quote Reply With Quote
  2. Jul 6th, 2001, 02:53 PM #2
    spetnik
    Guest
    http://www.norton.com
    http://www.mcafee.com

    PS, can u email it to me ([email protected])? We like lookin thru these @ work.
    Reply With Quote Reply With Quote
  3. Jul 6th, 2001, 03:04 PM #3
    chrisjk
    chrisjk is offline
    PowerPoster
    Join Date
    Jul 1999
    Posts
    5,923
    I wouldn't mind a butchers at this script kiddie's work...if you don't mind
    Reply With Quote Reply With Quote
  4. Jul 6th, 2001, 03:19 PM #4
    parksie
    parksie is offline
    Monday Morning Lunatic parksie's Avatar
    Join Date
    Mar 2000
    Location
    Mashin' on the motorway
    Posts
    8,169
    Same here, let's have a look
    I refuse to tie my hands behind my back and hear somebody say "Bend Over, Boy, Because You Have It Coming To You".
    -- Linus Torvalds
    Reply With Quote Reply With Quote
  6. Jul 6th, 2001, 03:22 PM #5
    spetnik
    Guest
    You know what's scary? Any of us could pop out a real nasty virus (that would land us 10+ years in jail) in about 10- minutes.
    Thats a year a minute.
    Reply With Quote Reply With Quote
  7. Jul 6th, 2001, 03:58 PM #6
    denniswrenn
    Guest
    Spetnik, Mike: Sending attachment as text file(homepage.html.vbs.txt), should be sent in a few minutes

    Chris: What's your email address?
    Reply With Quote Reply With Quote
  8. Jul 6th, 2001, 04:05 PM #7
    chrisjk
    chrisjk is offline
    PowerPoster
    Join Date
    Jul 1999
    Posts
    5,923
    damn, I knew I forgot something...

    [email protected] will do thanks!
    Reply With Quote Reply With Quote
  9. Jul 6th, 2001, 04:53 PM #8
    parksie
    parksie is offline
    Monday Morning Lunatic parksie's Avatar
    Join Date
    Mar 2000
    Location
    Mashin' on the motorway
    Posts
    8,169
    Okay just arrived...now to find some way of decoding it without VB installed... Access should do
    I refuse to tie my hands behind my back and hear somebody say "Bend Over, Boy, Because You Have It Coming To You".
    -- Linus Torvalds
    Reply With Quote Reply With Quote
  11. Jul 6th, 2001, 04:56 PM #9
    denniswrenn
    Guest
    I can send you the decoded version?
    Reply With Quote Reply With Quote
  12. Jul 6th, 2001, 04:58 PM #10
    parksie
    parksie is offline
    Monday Morning Lunatic parksie's Avatar
    Join Date
    Mar 2000
    Location
    Mashin' on the motorway
    Posts
    8,169
    I've disabled ZoneAlarm so it should be okay, yeah.
    I refuse to tie my hands behind my back and hear somebody say "Bend Over, Boy, Because You Have It Coming To You".
    -- Linus Torvalds
    Reply With Quote Reply With Quote
  13. Jul 6th, 2001, 05:10 PM #11
    spetnik
    Guest
    haha, hotmail blocked it (hey, fancy MS being capable of s/t like that ). but at least it let me fwd it to earthlink.

    hmm, its not that bad. at lest it dont @#$% up ur comp
    Reply With Quote Reply With Quote
  14. Jul 6th, 2001, 05:20 PM #12
    chrisjk
    chrisjk is offline
    PowerPoster
    Join Date
    Jul 1999
    Posts
    5,923
    guess who forgot to turn the AV off... Damn it can be annoying when you actually want to open an infected file!

    So what is all that crap being passed to the function? All the function does is change the peices of crap into something else...looks harmless enough. What does Decode produce? A bastard script?
    Reply With Quote Reply With Quote
  15. Jul 6th, 2001, 05:25 PM #13
    chrisjk
    chrisjk is offline
    PowerPoster
    Join Date
    Jul 1999
    Posts
    5,923
    Ahh, I got it!
    VB Code:
    1. On Error Resume Next

    2. Set WS = CreateObject("WScript.Shell")

    3. Set FSO= Createobject("scripting.filesystemobject")

    4. Folder=FSO.GetSpecialFolder(2)

    5.  
    6. Set InF=FSO.OpenTextFile(WScript.ScriptFullname,1)

    7. Do While InF.AtEndOfStream<>True

    8. ScriptBuffer=ScriptBuffer&InF.ReadLine&vbcrlf

    9. Loop
    Don't run that!!! I've taken a lot of it out anyway to protect the innocent
    Last edited by chrisjk; Jul 6th, 2001 at 05:33 PM.
    Reply With Quote Reply With Quote
  16. Jul 6th, 2001, 05:33 PM #14
    chenko
    Guest
    I had that a while ago i got 900 copies in 5 seconds !!
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules


Click Here to Expand Forum to Full Width