Results 1 to 8 of 8

Thread: Warning: an interesting little virus

  1. #1
    Junior Member
    Join Date
    Dec 2001
    Posts
    22

    Warning: an interesting little virus

    I got an interesting little trojan from an MP3

    It changed it's extension to .VBS (Visual Basic Script) as soon as Media Player tried to open it and executed of course

    I'm not sure exactly what it did, but it appears to be written by a columbian hacker called Sand Ja9e Gr0w and is called 'Plan Columbia' I think it's a metavarient of the vbs.Loveletter.B

    I posted this because of two reasons...

    1st it appears in all ways to be an .mp3 file untill run (as far as I can tell) so it means that someone figured out how to abuse WMP to execute a virus, so *watch everything you download*

    2nd, I have to say to the writed that it is pretty ingenious the way it alters startup pages and reg settings, and I hope that things get better for you hackers in Columbia, Sand
    The sky above the port was the color of a television, tuned to a dead channel- Neuromancer

  2. #2
    AO Curmudgeon rcgreen's Avatar
    Join Date
    Nov 2001
    Posts
    2,716

    Thumbs up

    Do you have windows set to hide your file extensions?
    Some people take advantage of the fact that
    many of us hide our file extensions and therefore
    can't see the fact that it is executable.
    I came in to the world with nothing. I still have most of it.

  3. #3

    Re: Warning: an interesting little virus

    Originally posted by Wintermut3
    I got an interesting little trojan from an MP3

    I think it's a metavarient of the vbs.Loveletter.B


    You're absolutely correct. It is a varient of the original Love letter. What virus protection software were you using?

  4. #4
    That's a good one. I bet it's another skript kiddie with a virus creation kit. lol, Colombian Hacker errr don't make me barf

  5. #5
    Junior Member
    Join Date
    Dec 2001
    Posts
    22
    I was using PC-cillin (I thinkl that's spellt right)
    The sky above the port was the color of a television, tuned to a dead channel- Neuromancer

  6. #6
    Senior Member
    Join Date
    Oct 2001
    Posts
    872

    Thumbs down Warning: Another Virus

    Yeah...I posted this here just because I didn't want to make a new thread. But there's another virus that, at this point is at Symantec's High Risk.

    It's called: JS.Gigger.A@mm and is a worm written in JavaScript. It uses Microsoft Outlook and mIRC to spread . It attempts to delete all files on the computer and tries to format your C:/ (C Drive) if the computer is successfully restarted.
    JS.Gigger.A@mm arrives as an email message that has the following
    characteristics (as stated with Symantec):

    Subject: Outlook Express Update
    Message: MSNSofware Co.
    Attachment: Mmsn_offline.htm

    Click here if you want some more info on this worm. It sounds a bit yucky. Everybody update their VirusKit. Lates.
    ...This Space For Rent.

    -[WebCarnage]

  7. #7
    Originally posted by rcgreen
    Do you have windows set to hide your file extensions?
    Some people take advantage of the fact that
    many of us hide our file extensions and therefore
    can't see the fact that it is executable.
    What sux about that is M$ has them hidden by DEFAULT...bunch of hucksters!

  8. #8
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,785
    ------------------------------------------------------------
    That's a good one. I bet it's another skript kiddie with a virus creation kit. lol, Colombian Hacker errr don't make me barf

    --------------------------------------------------------------

    sounds more like the work of the recording industry, trying to scare people away from file sharing.
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •