Re: hack for filtering "i love you" worm

[vogelke]

>> On Thu, 4 May 2000 19:28:32 -0400, 
>> "Searcher" <[EMAIL PROTECTED]> said:

R> Anyone can rename that .vbs to what ever they want and send it around
R> again so wouldn't it be more efficient to filter all .vbs attachments?

   The only safe way to handle this is to check any attachment for a
   Registry reference or an indication that Visual Basic is being run.
   Few if any legitimate attachments should be referring to the Registry,
   and all the mischief seems to be done via VB scripts.

   Unpacking an infected attachment (different virus) and running strings
   on it gave me the following:

        HKEY_CURRENT_USER\Software\Microsoft\Office\
        VB_Nam
        VBProjectOh
        VBComponents
        temp\VBE
        C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VBA\VBA332.DLL
        \VBE\MSForms.EXD

-- 
Karl Vogel
ASC/YCOA, Wright-Patterson AFB, OH 45433, USA
[EMAIL PROTECTED]  or  [EMAIL PROTECTED]