- NANOG - lists.nanog.org

What is wrong with COVAD?
by Dirk Harms-Merbitz 06 May '00

06 May '00

Right now a number of COVAD circuits in LA are down again. This is the 6th time this year that our COVAD customers are down. What is going on? Is anybody else using COVAD? Are you seeing a similar amount of problems? Dirk

2 1

Enough!
by Shawn McMahon 05 May '00

05 May '00

Can we stop sending copies of the worm and various cleaner scripts back and forth here in the list, please? Everyone here has the resources to go get either, and even if we didn't we wouldn't need 50 goddamn copies of it, OK? Besides, who in his right mind would run a VBS that says "Cleaner" that is received via unsolicited email attachment? Stop!

1 0

uuencoded Love Worm variant
by Eric Conrad 05 May '00

05 May '00

I caught one of these uuencoded 'in the wild'. It would have slipped through my filters if not for the standard Subject: line. ---<snip>--- kindly check the attached LOVELETTER coming from me. begin 666 LOVE-LETTER-FOR-YOU.TXT.vbs ---<snip>--- I've since updated my filters to catch uuencodes as well. On a lighter note, a clueless gateway forwarded 6 copies of the worm with the following helpful banner attached: ---<snip>--- kindly check the attached LOVELETTER coming from me. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by the latest virus scan software available for the presence of computer viruses. ********************************************************************** ------_=_NextPart_000_01BFB683.1FF56E54 Content-Type: application/octet-stream; name="LOVE-LETTER-FOR-YOU.TXT.vbs" --<snip>--- ...Eric

4 4

How long before NIPC decides we need one of these?
by Roland Dobbins 05 May '00

05 May '00

http://www.the-times.co.uk/news/pages/sti/2000/04/30/stinwenws01034.html -- ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

8 13

Major .au cw.net fiber cut.
by Roland Dobbins 05 May '00

05 May '00

FYI, there are reports of a major cw.net fiber cut in Australia, with multiple ISPs affected. Side-effects are said to include major degradation of the PSTN, Sydney stock-exchange slowdowns, and cash-machine issues. No precise details or ETR known at this time, nor data concerning North American/trans-Pacific second-order effects, if any. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

2 1

Re: Virus Update
by David Charlap 05 May '00

05 May '00

"Eric A. Hall" wrote: >> >> Many mail programs (including Netscape Communicator) have no VBS >> support in them, so they can not execute virusses like this one. > > Netscape relies on MIME type mappings. If there's a type defined > (which there is if you have Windows Scripting Host installed) then > it's an executable attachment. Right-click, "open in new window." I stand corrected. I just tested it by writing and mailing myself a VBS file. It opened, ran and was able to write my output file (after approving it in the "security warning" dialog.) I assumed that NS would treat VBS like executables. With an EXE attachment, you don't get the choice of launching it - the SaveAs dialog appears immediately. I think I'll inform NS that they've got a bug. They should be treating VBS like EXE and COM files. -- David

1 0

Virus Update
by Branden R. Williams 04 May '00

04 May '00

Ok, this thing is pretty nasty... Here is a quick summary of what it does. Should you run it, you will lose any files of the following extensions. They will be renamed to filename.extension.vbs with a fresh copy of the replication part. File extensions affected: vbs,vbe,js,jse,css,wsh,sct,hta,jpg,jpeg,mp2,mp3. Every file with that extension is overwritten with the virus. It looks to be localized to mounted hard drives. It does not appear to affect mapped network drives. It also makes a dozen or so registry entries including one to reset your start page to the following URL. http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwe… I have not gone to this URL yet to see what it is, but it downloads a copy of a file called WIN-BUGSFIX.exe. In addition, it creates a MIRC script called script.ini to DCC SEND this to whatever channel you are on. Of course it sends it to everyone in your address book with the subject ILOVEYOU. It looks to only affect people who actually run the vbs script. I would assume that if you are not on a Windows platform that you are not affected. I'll let you know more when we find more. Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

9 13

RE: Virus heads-up
by Mark Persiko 04 May '00

04 May '00

Symantec has posted a set of antivirus definitions to a public FTP site, to be used with Norton Antivirus on PC's. Here is the URL: ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton _antivirus/specdef/ Thanks, Mark - Mark C. Persiko, persiko(a)bvsd.k12.co.us - MIS Dept, Boulder Valley Public Schools > -----Original Message----- > From: Simon Lockhart [mailto:simonl@rd.bbc.co.uk] > Sent: Thursday, May 04, 2000 4:18 AM > To: nanog(a)merit.edu > Subject: Virus heads-up > > > > Heads up on a new virus - ILOVEYOU > > I'm sure you've heard about it already, but you may wish to block > www.skyinet.net (206.101.197.226) at your borders, as that is > where it > fetches part of the actual virus code from: > > 132.185.x.y - - [04/May/2000:10:23:14 +0100] "GET > http://www.skyinet.net/~y > oung1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679n > jbvYT/WIN-BUG > SFIX.exe HTTP/1.0" > > Other than that, it looks like just another Melissa. > > Simon > -- > Simon Lockhart | Tel: +44 (0)1737 839676 > Internet Engineering Manager | Fax: +44 (0)1737 839516 > BBC Internet Services | Email: > Simon.Lockhart(a)bbc.co.uk > Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

1 0

Re: Virus Update
by Mark Borchers 04 May '00

04 May '00

On 4 May 00, at 11:57, John Gonzalez/netMDC admin wrote: Date sent: Thu, 4 May 2000 11:57:16 -0600 (MDT) From: John Gonzalez/netMDC admin <ekool(a)ns1.netmdc.com> To: Mark Borchers <markb(a)infi.net> Copies to: nanog(a)merit.edu Subject: Re: Virus Update > On Thu, 4 May 2000, Mark Borchers wrote: > >Tim Cartwright here at Splitrock has written a cleaner > >(attached). > > URL? :) Sorry, it was in an attachment which evidently did not make it out to the mailing list. Here it is. 'Written 4-04-2000 by : Tim Cartwright 'This is in response to the LOVE-LETTER-FOR-YOU virus. Needs to be run before computer re-boot. objWinDir objSystem32DirobjTempDir objDownLoadDir strDownLoadFolder objFsoobjFso = CreateObject("Scripting.FileSystemObject") Main() Main() On Error Resume Next Set objWinDir = objFso.GetSpecialFolder(0) Set objSystem32Dir = objFso.GetSpecialFolder(1) Set objTempDir = objFso.GetSpecialFolder(2) strDownLoadFolder = RegRead("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download Directory") If (strDownLoadFolder = "") then strDownLoadFolder = "c:\" End If If objFso.FileExists(strDownLoadFolder & "\WIN-BUGSFIX.exe") Then DeleteAFile strDownLoadFolder & "\WIN-BUGSFIX.exe" End If If objFso.FileExists(objSystem32Dir & "\MSKernel32.vbs") Then DeleteAFile objSystem32Dir & "\MSKernel32.vbs" End If If objFso.FileExists(objWinDir & "\Win32DLL.vbs") Then DeleteAFile objWinDir & "\Win32DLL.vbs" End If If objFso.FileExists(objSystem32Dir & "\LOVE-LETTER-FOR- YOU.TXT.vbs") Then DeleteAFile objSystem32Dir & "\LOVE-LETTER-FOR-YOU.TXT.vbs" End If RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.microsoft.com/" RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServi ces\Win32DLL" RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKe rnel32" RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN- BUGSFIX" MsgBox "Done."Sub RegDelete(strRegKey) On Error Resume Next Dim objRegEdit Set objRegEdit = CreateObject("WScript.Shell") objRegEdit.RegDelete strRegKey If Err.Number <> 0 Then Select Case Err.Number Case -2147024894 'key does not exist 'ignore Case Else MsgBox Err.Number & " Error deleteing key : " & strRegKey & " " & Err.Description End Select Err.Clear End IfSub RegRead(strKey) Dim objRegEdit Set objRegEdit = CreateObject("WScript.Shell") RegRead = objRegEdit.RegRead(strKey)Function DeleteAFile(filespec) objFso.DeleteFile(filespec)Sub RegWrite(strRegKey,strRegValue) Dim objRegEdit Set objRegEdit = CreateObject("WScript.Shell") objRegEdit.RegWrite strRegKey, strRegValueSub

1 0

RE: Virus Update
by Branden R. Williams 04 May '00

04 May '00

On Thu, 4 May 2000 msarges(a)midco.net wrote: > Just to clarify, it will look at files on network or net-mapped drives. > Our organization just found out the hard way. Ok, we must have stopped it before that happened to us. The person who ran this (argh) only affected their own hard drive and missed any network drives. > On 04-May-2000 Branden R. Williams wrote: > > > > Ok, this thing is pretty nasty... Here is a quick summary of what it > > does. > > > > Should you run it, you will lose any files of the following > > extensions. They will be renamed to filename.extension.vbs with a fresh > > copy of the replication part. > > > > File extensions > > affected: vbs,vbe,js,jse,css,wsh,sct,hta,jpg,jpeg,mp2,mp3. > > > > Every file with that extension is overwritten with the virus. It looks to > > be localized to mounted hard drives. It does not appear to affect mapped > > network drives. > > > > It also makes a dozen or so registry entries including one to reset your > > start page to the following URL. > > > > http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwe… > > djhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe > > > > I have not gone to this URL yet to see what it is, but it downloads a copy > > of a file called WIN-BUGSFIX.exe. > > > > In addition, it creates a MIRC script called script.ini to DCC SEND this > > to whatever channel you are on. > > > > Of course it sends it to everyone in your address book with the subject > > ILOVEYOU. It looks to only affect people who actually run the vbs > > script. I would assume that if you are not on a Windows platform that you > > are not affected. > > > > I'll let you know more when we find more. > > > > Cheers, > > > > Branden R. Williams <brw(a)netvitality.net> > > Vice President, Systems - NetVitality, Inc. > > http://www.netvitality.net/ > > Internet Commerce Specialists > > ---------------------------------- > E-Mail: msarges(a)midco.net > Date: 04-May-2000 > Time: 10:49:31 > > We have met the enemy, and he is us. > -- Walt Kelly > > ---------------------------------- > Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

1 0