Lots of people replied this is a worm/virus/trojan called VBS.Freelink.
For more information:
http://www.sarc.com/avcenter/venc/data/vbs.freelink.html
http://www.symantec.com/region/uk/avcenter/venc/vbs_freelink.html
http://vil.mcafee.com/vil/vbs10225.asp
http://www.DataFellows.com/v-descs/freelink.htm
http://www.trend.com/vinfo/virusencyclo/default5.asp?VName=VBS_FREELINK.
http://vil.nai.com/villib/alpha.asp
http://vil.nai.com/vil/vbs10225.asp
Decrypted versions of links.vbs and rundll.vbs:
http://www.tirsek.dk/bugtraq/links_vbs.txt
http://www.tirsek.dk/bugtraq/rundll_vbs.txt
Highlights:
* The worm spread via email, IRC if it can find mIRC and
by copying itself to network drives.
* Its not new, but it has spread wide recently.
* Most scanner are not configured to look for .VBS files by default.
You must tell your scanner to look for them.
Thanks:
Norbert Luckhardt <[EMAIL PROTECTED]>
Eric Chien <[EMAIL PROTECTED]>
Peter Tirsek <[EMAIL PROTECTED]>
Pollard, Bette <[EMAIL PROTECTED]>
Rodefeld, Sonja <[EMAIL PROTECTED]>
Jaapar, Jazzery <[EMAIL PROTECTED]>
Christopher P. Lindsey <[EMAIL PROTECTED]>
[EMAIL PROTECTED]
Dennis Dow <[EMAIL PROTECTED]>
Tim Sole <[EMAIL PROTECTED]>
Dan Schrader <[EMAIL PROTECTED]>
--
Elias Levy
Security Focus
http://www.securityfocus.com/
