PPRuNe Forums - View Single Post - A link to a PPRuNe thread regards a serious virus alert
Old 7th May 2000 | 18:36
  #21 (permalink)  
Feline
Guest
 
Posts: n/a
Exclamation

Even if you disable Host Scripting (as described by Velvet Strokes above) it seems possible to run a Visual Basic Script file if wscript.exe is present on your system.
To make absolutely sure that you can't get infected or re-infected, do the following two things:

1) Search for wscript.exe using the "Find" function from the Start Menu (it should be in the Windows root folder). Rename it wscript.xex.
That way it won't run, but if you really need it at a later stage, you can simply rename it back to .exe and it will run.

2) Remove the file association between Visual Basic Script (.VBS) files and wscript.exe: Double Click on the "My Computer" icon, choose "View", "Options", "File Types" and scroll down to "Visual Basic". Click "Remove" to get rid of this file association.

I would STRONGLY recommend you take these two steps because there are now so many variants of the original LoveBug virus floating around that you could get caught at some time in the future when all the current fuss has died down. And some of the variants do even nastier things than the original.

This may come across as applying belt and braces after the horse has bolted, but I suspect that Visual Basic Scripts execute when selected (single click) and not when executed (double click). I base this on the observation that when I was trying to clear up my system and simply "select" some .jpg.vbs files to delete from Windows Explorer, the little bugger tried to execute (but I had renamed wscript.exe by this time, so windows just grumbled).

If this is the case (and I'm not about to waste yet more time trying to prove the point), then a lot of folk may be re-infecting their systems while trying to tidy it up using Windows Explorer.


------------------
Feline
(I Sit, I Watch, I Smile)