A link to a PPRuNe thread regards a serious virus alert
Guest
Posts: n/a
Even if you disable Host Scripting (as described by Velvet Strokes above) it seems possible to run a Visual Basic Script file if wscript.exe is present on your system.
To make absolutely sure that you can't get infected or re-infected, do the following two things:
1) Search for wscript.exe using the "Find" function from the Start Menu (it should be in the Windows root folder). Rename it wscript.xex.
That way it won't run, but if you really need it at a later stage, you can simply rename it back to .exe and it will run.
2) Remove the file association between Visual Basic Script (.VBS) files and wscript.exe: Double Click on the "My Computer" icon, choose "View", "Options", "File Types" and scroll down to "Visual Basic". Click "Remove" to get rid of this file association.
I would STRONGLY recommend you take these two steps because there are now so many variants of the original LoveBug virus floating around that you could get caught at some time in the future when all the current fuss has died down. And some of the variants do even nastier things than the original.
This may come across as applying belt and braces after the horse has bolted, but I suspect that Visual Basic Scripts execute when selected (single click) and not when executed (double click). I base this on the observation that when I was trying to clear up my system and simply "select" some .jpg.vbs files to delete from Windows Explorer, the little bugger tried to execute (but I had renamed wscript.exe by this time, so windows just grumbled).
If this is the case (and I'm not about to waste yet more time trying to prove the point), then a lot of folk may be re-infecting their systems while trying to tidy it up using Windows Explorer.
------------------
Feline
(I Sit, I Watch, I Smile)
To make absolutely sure that you can't get infected or re-infected, do the following two things:
1) Search for wscript.exe using the "Find" function from the Start Menu (it should be in the Windows root folder). Rename it wscript.xex.
That way it won't run, but if you really need it at a later stage, you can simply rename it back to .exe and it will run.
2) Remove the file association between Visual Basic Script (.VBS) files and wscript.exe: Double Click on the "My Computer" icon, choose "View", "Options", "File Types" and scroll down to "Visual Basic". Click "Remove" to get rid of this file association.
I would STRONGLY recommend you take these two steps because there are now so many variants of the original LoveBug virus floating around that you could get caught at some time in the future when all the current fuss has died down. And some of the variants do even nastier things than the original.
This may come across as applying belt and braces after the horse has bolted, but I suspect that Visual Basic Scripts execute when selected (single click) and not when executed (double click). I base this on the observation that when I was trying to clear up my system and simply "select" some .jpg.vbs files to delete from Windows Explorer, the little bugger tried to execute (but I had renamed wscript.exe by this time, so windows just grumbled).
If this is the case (and I'm not about to waste yet more time trying to prove the point), then a lot of folk may be re-infecting their systems while trying to tidy it up using Windows Explorer.
------------------
Feline
(I Sit, I Watch, I Smile)
Guest
Posts: n/a
ExSimGuy,
I don't think that disabling Host Scripting will nobble Excel and Word Macros, because they are not Visual Basic Scripts, they are native to the applications (ie. Excel and Word interpret them without needing wscript.exe). Of course, if you include a Visual Basic Script within the macro then it would be a problem, but I suspect that most people don't aspire to that level of deviousness). (Mind you with some of the people that hang around these forums, that is of course a possibility, but my observation is that they tend to be devious - or deviant - in other ways). See too my previous post.
------------------
Feline
(I Sit, I Watch, I Smile)
I don't think that disabling Host Scripting will nobble Excel and Word Macros, because they are not Visual Basic Scripts, they are native to the applications (ie. Excel and Word interpret them without needing wscript.exe). Of course, if you include a Visual Basic Script within the macro then it would be a problem, but I suspect that most people don't aspire to that level of deviousness). (Mind you with some of the people that hang around these forums, that is of course a possibility, but my observation is that they tend to be devious - or deviant - in other ways). See too my previous post.
------------------
Feline
(I Sit, I Watch, I Smile)
Guest
Posts: n/a
ExSimGuy,
Mate, I'm buggered if I know how it launches itself,
I'm just going by the reports here and elsewhere on the Net.
Luckily, I have never setup MSMail or Netscape Mail.
I've been using Eudora Pro 3.05 since it was introduced, (in pref to Pro4.05)
When my only 'Loveletter' arrived, I dumped it without opening it, and poured a large G & T
Why chance it?
Mate, I'm buggered if I know how it launches itself,
I'm just going by the reports here and elsewhere on the Net.
Luckily, I have never setup MSMail or Netscape Mail.
I've been using Eudora Pro 3.05 since it was introduced, (in pref to Pro4.05)
When my only 'Loveletter' arrived, I dumped it without opening it, and poured a large G & T
Why chance it?
