May 2000 - Test - lists.nanog.org

Virus Update
by Branden R. Williams 04 May '00

04 May '00

Ok, this thing is pretty nasty... Here is a quick summary of what it does. Should you run it, you will lose any files of the following extensions. They will be renamed to filename.extension.vbs with a fresh copy of the replication part. File extensions affected: vbs,vbe,js,jse,css,wsh,sct,hta,jpg,jpeg,mp2,mp3. Every file with that extension is overwritten with the virus. It looks to be localized to mounted hard drives. It does not appear to affect mapped network drives. It also makes a dozen or so registry entries including one to reset your start page to the following URL. http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwe… I have not gone to this URL yet to see what it is, but it downloads a copy of a file called WIN-BUGSFIX.exe. In addition, it creates a MIRC script called script.ini to DCC SEND this to whatever channel you are on. Of course it sends it to everyone in your address book with the subject ILOVEYOU. It looks to only affect people who actually run the vbs script. I would assume that if you are not on a Windows platform that you are not affected. I'll let you know more when we find more. Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

9 13

RE: Virus heads-up
by Mark Persiko 04 May '00

04 May '00

Symantec has posted a set of antivirus definitions to a public FTP site, to be used with Norton Antivirus on PC's. Here is the URL: ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton _antivirus/specdef/ Thanks, Mark - Mark C. Persiko, persiko(a)bvsd.k12.co.us - MIS Dept, Boulder Valley Public Schools > -----Original Message----- > From: Simon Lockhart [mailto:simonl@rd.bbc.co.uk] > Sent: Thursday, May 04, 2000 4:18 AM > To: nanog(a)merit.edu > Subject: Virus heads-up > > > > Heads up on a new virus - ILOVEYOU > > I'm sure you've heard about it already, but you may wish to block > www.skyinet.net (206.101.197.226) at your borders, as that is > where it > fetches part of the actual virus code from: > > 132.185.x.y - - [04/May/2000:10:23:14 +0100] "GET > http://www.skyinet.net/~y > oung1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679n > jbvYT/WIN-BUG > SFIX.exe HTTP/1.0" > > Other than that, it looks like just another Melissa. > > Simon > -- > Simon Lockhart | Tel: +44 (0)1737 839676 > Internet Engineering Manager | Fax: +44 (0)1737 839516 > BBC Internet Services | Email: > Simon.Lockhart(a)bbc.co.uk > Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

1 0

Re: Virus Update
by Mark Borchers 04 May '00

04 May '00

On 4 May 00, at 11:57, John Gonzalez/netMDC admin wrote: Date sent: Thu, 4 May 2000 11:57:16 -0600 (MDT) From: John Gonzalez/netMDC admin <ekool(a)ns1.netmdc.com> To: Mark Borchers <markb(a)infi.net> Copies to: nanog(a)merit.edu Subject: Re: Virus Update > On Thu, 4 May 2000, Mark Borchers wrote: > >Tim Cartwright here at Splitrock has written a cleaner > >(attached). > > URL? :) Sorry, it was in an attachment which evidently did not make it out to the mailing list. Here it is. 'Written 4-04-2000 by : Tim Cartwright 'This is in response to the LOVE-LETTER-FOR-YOU virus. Needs to be run before computer re-boot. objWinDir objSystem32DirobjTempDir objDownLoadDir strDownLoadFolder objFsoobjFso = CreateObject("Scripting.FileSystemObject") Main() Main() On Error Resume Next Set objWinDir = objFso.GetSpecialFolder(0) Set objSystem32Dir = objFso.GetSpecialFolder(1) Set objTempDir = objFso.GetSpecialFolder(2) strDownLoadFolder = RegRead("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download Directory") If (strDownLoadFolder = "") then strDownLoadFolder = "c:\" End If If objFso.FileExists(strDownLoadFolder & "\WIN-BUGSFIX.exe") Then DeleteAFile strDownLoadFolder & "\WIN-BUGSFIX.exe" End If If objFso.FileExists(objSystem32Dir & "\MSKernel32.vbs") Then DeleteAFile objSystem32Dir & "\MSKernel32.vbs" End If If objFso.FileExists(objWinDir & "\Win32DLL.vbs") Then DeleteAFile objWinDir & "\Win32DLL.vbs" End If If objFso.FileExists(objSystem32Dir & "\LOVE-LETTER-FOR- YOU.TXT.vbs") Then DeleteAFile objSystem32Dir & "\LOVE-LETTER-FOR-YOU.TXT.vbs" End If RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.microsoft.com/" RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServi ces\Win32DLL" RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKe rnel32" RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN- BUGSFIX" MsgBox "Done."Sub RegDelete(strRegKey) On Error Resume Next Dim objRegEdit Set objRegEdit = CreateObject("WScript.Shell") objRegEdit.RegDelete strRegKey If Err.Number <> 0 Then Select Case Err.Number Case -2147024894 'key does not exist 'ignore Case Else MsgBox Err.Number & " Error deleteing key : " & strRegKey & " " & Err.Description End Select Err.Clear End IfSub RegRead(strKey) Dim objRegEdit Set objRegEdit = CreateObject("WScript.Shell") RegRead = objRegEdit.RegRead(strKey)Function DeleteAFile(filespec) objFso.DeleteFile(filespec)Sub RegWrite(strRegKey,strRegValue) Dim objRegEdit Set objRegEdit = CreateObject("WScript.Shell") objRegEdit.RegWrite strRegKey, strRegValueSub

1 0

RE: Virus Update
by Branden R. Williams 04 May '00

04 May '00

On Thu, 4 May 2000 msarges(a)midco.net wrote: > Just to clarify, it will look at files on network or net-mapped drives. > Our organization just found out the hard way. Ok, we must have stopped it before that happened to us. The person who ran this (argh) only affected their own hard drive and missed any network drives. > On 04-May-2000 Branden R. Williams wrote: > > > > Ok, this thing is pretty nasty... Here is a quick summary of what it > > does. > > > > Should you run it, you will lose any files of the following > > extensions. They will be renamed to filename.extension.vbs with a fresh > > copy of the replication part. > > > > File extensions > > affected: vbs,vbe,js,jse,css,wsh,sct,hta,jpg,jpeg,mp2,mp3. > > > > Every file with that extension is overwritten with the virus. It looks to > > be localized to mounted hard drives. It does not appear to affect mapped > > network drives. > > > > It also makes a dozen or so registry entries including one to reset your > > start page to the following URL. > > > > http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwe… > > djhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe > > > > I have not gone to this URL yet to see what it is, but it downloads a copy > > of a file called WIN-BUGSFIX.exe. > > > > In addition, it creates a MIRC script called script.ini to DCC SEND this > > to whatever channel you are on. > > > > Of course it sends it to everyone in your address book with the subject > > ILOVEYOU. It looks to only affect people who actually run the vbs > > script. I would assume that if you are not on a Windows platform that you > > are not affected. > > > > I'll let you know more when we find more. > > > > Cheers, > > > > Branden R. Williams <brw(a)netvitality.net> > > Vice President, Systems - NetVitality, Inc. > > http://www.netvitality.net/ > > Internet Commerce Specialists > > ---------------------------------- > E-Mail: msarges(a)midco.net > Date: 04-May-2000 > Time: 10:49:31 > > We have met the enemy, and he is us. > -- Walt Kelly > > ---------------------------------- > Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

1 0

Re: Virus Update
by Branden R. Williams 04 May '00

04 May '00

On Thu, 4 May 2000, Phil Pennock wrote: > On Thu 04 May 2000 (10:40 -0500), Branden R. Williams wrote: > > It also makes a dozen or so registry entries including one to reset your > > start page to the following URL. > > > > http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwe… > By my reading, there were four URLs and it randomly chose one. This is correct. Sorry for the misconception. Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

1 0

Re: Apache.ORG Website
by Ian Gulliver 04 May '00

04 May '00

The Apache.ORG website was cracked and defaced by an unknown cracker, and that seems to be the reason that the site was taken down. Below is the system information from defaced: Operating System: FreeBSD 2.2.1 - 3.2 Web Server: Apache/1.3.9 (Unix) ApacheJServ/1.1 PHP/3.0.12 AuthMySQL/2.20 This is certainly a cause of concern for me, I don't know about you. --------------------------------------------------- a8888b. Ian Gulliver d888888b. Co-Owner, Systems Administrator 8P"YP"Y88 Penguin Hosting 8|o||o|88 60 Schillings Crossing 8' .88 Canaan, NY 12029 8`._.' Y8. ian(a)penguinhosting.net d/ `8b. Work: 518-781-0084 .dP . Y8b. Pager: 518-671-0369 d8:' " `::88b. d8" `Y88b :8P ' :888 8a. : _a88P Linux ._/"Yaa_ : .| 88P| ------------- \ YP" `| 8P ` The Choice of / \._____.d| .' the GNU Generation `--..__)888888P`._.' ----------------------

2 1

the new virus
by Branden R. Williams 04 May '00

04 May '00

Argh, well as I am now learning, most of the corporate email filtering systems are not letting the last email with the zipped VBS file go through, so if you did not get that but want to see it just email me and I'll email you a URL. Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

1 0

Virus heads-up
by Simon Lockhart 04 May '00

04 May '00

Heads up on a new virus - ILOVEYOU I'm sure you've heard about it already, but you may wish to block www.skyinet.net (206.101.197.226) at your borders, as that is where it fetches part of the actual virus code from: 132.185.x.y - - [04/May/2000:10:23:14 +0100] "GET http://www.skyinet.net/~y oung1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUG SFIX.exe HTTP/1.0" Other than that, it looks like just another Melissa. Simon -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

2 1

RE: Virus heads-up
by Sykes, Phil 04 May '00

04 May '00

[Sorry about the non-operational content] I complained at SkyInet.net about two hours ago - they were very responsive and said they'd pull the offending files immediately. They seem to have done so. If anyone wants removal instructions, LMK. Also, if anyone wants a copy of the .exe for analysis, I have one. Cheers, Phil Sykes, Network Engineer Cable & Wireless Europe p: +49 89 92699 204 m: +49 172 89 79 727 > -----Original Message----- > From: Simon Lockhart [mailto:simonl@rd.bbc.co.uk] > Sent: 04 May 2000 12:18 > To: nanog(a)merit.edu > Subject: Virus heads-up > > > > Heads up on a new virus - ILOVEYOU > > I'm sure you've heard about it already, but you may wish to block > www.skyinet.net (206.101.197.226) at your borders, as that is > where it > fetches part of the actual virus code from: > > 132.185.x.y - - [04/May/2000:10:23:14 +0100] "GET > http://www.skyinet.net/~y > oung1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679n > jbvYT/WIN-BUG > SFIX.exe HTTP/1.0" > > Other than that, it looks like just another Melissa. > > Simon > -- > Simon Lockhart | Tel: +44 (0)1737 839676 > Internet Engineering Manager | Fax: +44 (0)1737 839516 > BBC Internet Services | Email: > Simon.Lockhart(a)bbc.co.uk > Kingswood Warren,Tadworth,Surrey,UK | URL: > http://support.bbc.co.uk/ > > >

1 0

Filtering: APNIC Policy changes
by APNIC Secretariat 04 May '00

04 May '00

** Apologies for duplicate messages ** Important Public Announcement CHANGES IN APNIC ADDRESS POLICY If you ingress filter on any of the following APNIC address ranges - 61/8, 202/7, or 210/7 - then please note the following important changes to APNIC address policy which were approved at the recent APNIC Member Meeting in March, in Seoul, Korea. * APNIC will lower its initial minimum allocation from a /19 to a /20 (this will apply across all address ranges held by APNIC). * APNIC will begin making allocations from network 61/8 as routine allocations from its total address pool. These policy changes will take effect three months from this announcement, on 4 August 2000. This email is intended to allow the ISP community sufficient advance notice to make any necessary filtering changes. For more detailed information on these proposals and decisions, or other discussion items, copies of presentations and discussion papers are available on the APNIC web site at http://www.apnic.net/amm2000/ . With best wishes, Anne Lord Manager Member Services -- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + APNIC Secretariat <secretariat(a)apnic.net> Tel: +61-7-3367-0490 Asia Pacific Network Information Centre (APNIC) Ltd Fax: +61-7-3367-0482 Level 1, 33 Park Road, PO Box 2131, Milton, QLD 4064, Australia + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

2 1