Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

mesage:"virus found"

[es] :: Zaštita :: mesage:"virus found"

[ Pregleda: 6039 | Odgovora: 1 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

filipc

Član broj: 22738
Poruke: 433
212.200.108.*



Profil

icon mesage:"virus found"21.03.2004. u 10:00 - pre 243 meseci
kakda startujem windows pojavi se poruka :"virus found :VBS_FREELINK"
Da li neko zna kakav je ovo virus i da li je opasan?
unapred zahvalan
 
Odgovor na temu

VRKY

Član broj: 21087
Poruke: 4690
*.net.htnet.hr



+8 Profil

icon Re: mesage:"virus found"21.03.2004. u 11:52 - pre 243 meseci
Nisam siguran da je to to al

VBS/FreeLinks
Aliases
VBS/Freelink, VBS.Freelinks, VBS.Freelink, Freelink/VBS

Type
Visual Basic Script worm

Detection
Detected by Sophos Anti-Virus since July 1999.

Description
This virus is an encrypted VB Script virus that spreads itself by email, network drive sharing and IRC client scripting abilities. The virus spreads as an email message with subject "Check this". The message text is "Have fun with this cool links", and the message attachment is the actual virus.

If the attached VBS script (LINKS.VBS) is run, it displays a message "This will add a shortcut to free XXX links on your desktop. Do you want to continue ?".



If the answer is yes the virus creates a .URL file that contains a link to an adult website.

The virus makes changes to the Windows registry key \HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN\Rundll so that C:\WINDOWS\SYSTEM\RUNDLL.VBS is run every time the infected computer is rebooted. The RUNDLL.VBS file checks if there are mIRC or PIRCH IRC clients installed and if any of these are, the virus creates a SCRIPT.INI or EVENTS.INI file which sends the virus to other users on the same IRC channel on a JOIN channel event.

If there is a shared network disk drive, the virus will copy itself to the drive and therefore spread through a network. The virus attempts to create and send the above email message to all entries in the user's Outlook address book.


Recovery
Please read the instructions for removing worms.
Check other computers on your network to ensure that the worm has not spread.

Windows NT/2000

After deleting the worm files in Windows NT/2000 you will need to delete the following registry key. The removal of this key is optional in Windows 95/98/Me.

At the Windows taskbar, select Start|Run. Type 'Regedit' and press return. The registry editor will open.

Before you edit the registry, you should make a backup. In the Registry menu, click on Export Registry File, in Export Range select All, then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN\Rundll

and delete it if it exists.

Close the Registry Editor and restart your computer.



 
Odgovor na temu

[es] :: Zaštita :: mesage:"virus found"

[ Pregleda: 6039 | Odgovora: 1 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.