Hati-hati dengan virus terlampir. Semoga bermanfaat. salam, Eriyawan ----- Original Message ----- From: "Vaksin" <[EMAIL PROTECTED]> To: "Antivirusclub" <[EMAIL PROTECTED]>; "Vaksin" <[EMAIL PROTECTED]>; "Genetika" <[EMAIL PROTECTED]> Sent: Friday, June 01, 2001 2:10 PM Subject: [GENETIK@] Don't click JENNIFER_LOPEZ attachment, Destructive Virus !! > > Jennifer lopez > Alias : Jennifer Lopez, VBS.Loveletter.CM@mm, VBS.Lopez.A@mm > Source : http://www.sophos.com/virusinfo/analyses/vbsloveletcm.html > Jika anda penggemar J-Lo, hati-hati kalau menerima email dengan attachment yang menjanjikan gambar Jennifer Lopez tanpa busana, bisa-bisa komputer anda di rusak oleh virus CIH yang ikut terkandung dalam virus tersebut. > Virus ini seperti biasanya menggunakan Microsoft Outlook untuk menyebarkan dirinya dengan perincian : > Subject: Where are you? > Body text: This is my pic in the beach! > Attached file: JENNIFERLOPEZ_NAKED.JPG.vbs > > Jika diaktifkan, file-file dengan attachment .VBS, .VBE, .JS, .JSE, .CSS, .WSH, .SCT, .HTA, JPG, .JPEG, .MP2 dan .MP3 akan di timpa dengan data tidak berguna. > Ekstensi .JS, .JSE, .CSS, .WSH, .SCT dan HTA diganti menjadi .VBS. .JPG dam . JPEG di konvesi menjadi .JPG.VBS dan .JPEG.VBS. File-file .MP2 dan . MP3 akan disembunyikan dan diganti dengan file lain dengan nama yang sama namun berekstensi VBS. > Yang berbahaya adalah, virus ini akan menularkan file yang sudah terinfeksi CIH (Chernobyl) > > In English : > VBS/Lovelet-CM is an email-aware worm. The worm copies itself to a file called JENNIFERLOPEZ_NAKED.JPG.vbs in the Windows directory. It then forwards itself via email to every contact in the Microsoft Outlook address book with the following characteristics: > Subject: Where are you? > Body text: This is my pic in the beach! > Attached file: JENNIFERLOPEZ_NAKED.JPG.vbs > When the attached file is opened the worm searches all fixed and network drives for files with extensions .VBS, .VBE, .JS, .JSE, .CSS, .WSH, .SCT, .HTA, JPG, .JPEG, .MP2 and .MP3. All found files are overwritten by the worm. > Original extensions .JS, .JSE, .CSS, .WSH, .SCT and HTA are changed to .VBS. Original extensions .JPG and .JPEG are converted to double extension .JPG.VBS and .JPEG.VBS respectively. Attributes of the original files with .MP2 and .MP3 extension are changed so that the original file is hidden and a new file with the identical name and VBS extension is created by the worm. > The worm also creates the Registry keys HKCU\software\JENNIFERLOPEZ_NAKED\ so that it contains the text "Worm made in algeria" and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion \Run, so that it contains the name of the worm file. The worm then sends itself to all contacts found in the Microsoft Outlook address book. > Finally it drops and runs a file infected with a variant of the highly destructive W95/CIH virus (also known as Chernobyl). The dropped file is detected by SAV as W95/CIH-10xx. > -----------V------------- > From the desk of : > Vaksin.com > Certified Virus Free > > Go To : > http://www.vaksin.com > For Antivirus, Firewall > & Data Recovery > > Persistence Virus ?? > Sent sample to : > [EMAIL PROTECTED] > -----------V------------- > To unsubscribe from this group, send an email to: > [EMAIL PROTECTED] > > > > Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ > > > --------------------------------------------------------------------- Mulai langganan: kirim e-mail ke [EMAIL PROTECTED] Stop langganan: kirim e-mail ke [EMAIL PROTECTED] Archive ada di http://www.mail-archive.com/[email protected]
