Page 1 of 1 1
Topic Options
#2795 - 2000-05-06 02:27 AM Complete FIX for all variations of "VBS/LoveLetter.worm" virus.
MCA Offline
KiX Supporter
*****

Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
A complete update of code has been added to page
http://kixtart.to/script/board/ubbhtml/Forum2/HTML/000473.html

to prevent damage to your computer. Also tips + tricks for people at HOME and for people who aren't running Kixtart.
greetings


[This message has been edited by MCA (edited 06 May 2000).]

_________________________
email scripting@wanadoo.nl homepage scripting@wanadoo.nl | Links | Summary of Site Site KiXforms FAQ kixtart.org library collection mirror MCA | FAQ & UDF help file UDF kixtart.org library collection mirror MCA | mirror USA | mirror europe UDF scriptlogic library collection UDFs | mirror MCA

Top
#2796 - 2000-05-26 08:59 PM Re: Complete FIX for all variations of "VBS/LoveLetter.worm" virus.
MCA Offline
KiX Supporter
*****

Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
Dear,

Another script for making a complete inventory of running McAfee software has been made, which list shows you which Netshield version, engine edition and definition files are using.

You find script and examples on Topic page:

http://kixtart.to/script/board/ubbhtml/Forum2/HTML/000534.html

Greetings.

_________________________
email scripting@wanadoo.nl homepage scripting@wanadoo.nl | Links | Summary of Site Site KiXforms FAQ kixtart.org library collection mirror MCA | FAQ & UDF help file UDF kixtart.org library collection mirror MCA | mirror USA | mirror europe UDF scriptlogic library collection UDFs | mirror MCA

Top
#2797 - 2000-06-01 07:59 AM Re: Complete FIX for all variations of "VBS/LoveLetter.worm" virus.
Anonymous
Unregistered


What I did will prevent errors to the best of my knowledge (errors with missing vbscript or wscript engine): (This changes the association of vbs file to notepad) Thus if an enduser downloads or trys to open a vbs file it simply opens in notepad (on NT it says can't find the path for notepad.exe)

I put the following call in my login script:
REGEDIT.EXE /s J:\VBSNOTEP.REG

Contents of VBSNOTE.REGREGEDIT4

[HKEY_CLASSES_ROOT\VBSFile]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\VBSFile\Shell]
@=""

[HKEY_CLASSES_ROOT\VBSFile\Shell\Edit]
"EditFlags"=hex:01,00,00,00

[HKEY_CLASSES_ROOT\VBSFile\Shell\Open]
"EditFlags"=hex:01,00,00,00

[HKEY_CLASSES_ROOT\VBSFile\Shell\Open2]
"EditFlags"=hex:01,00,00,00

[HKEY_CLASSES_ROOT\VBSFile\Shell\Open2\Command]
@="C:\\WINDOWS\\COMMAND\\notepad.exe \"%1\" %*"

[HKEY_CLASSES_ROOT\VBSFile\Shell\Open\Command]
@="C:\\WINDOWS\\Notepad.exe \"%1\" %*"

[HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host]

[HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count]
"HRZR_EHAJZPZQ"=hex:01,00,00,00,12,00,00,00
"HRZR_EHAJZPZQ:0k2,n123"=hex:01,00,00,00,0a,00,00,00


------------------
Steve Agnew
MCSE since 1997
SteveAgnew@aol.com

[This message has been edited by SteveAgnew (edited 01 June 2000).]

Top
#2798 - 2000-06-15 06:21 PM Re: Complete FIX for all variations of "VBS/LoveLetter.worm" virus.
MCA Offline
KiX Supporter
*****

Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
Another way is simple change the default shell mode from [open to edit

Example of code:

code:

$info=""
$debug_mode="yes"
;
IF ($debug_mode = "yes")
?
? "-REGISTRY PART- HKCR - regfile + vbsfile"
?
ENDIF
;
; change "open" mode to "edit" mode. prevents automatically run a VBS file.
;
$ikey="HKEY_CLASSES_ROOT\vbsfile\shell"
$ikey_ex=ENUMVALUE($ikey, 0)
$default_key="edit"
IF (ExistKey($ikey+"\"+$ikey_ex) = 0)
$result_data_type=ReadType($ikey, $ikey_ex)
ELSE
$result_data_type="REG_SZ"
ENDIF
IF (ReadValue($ikey, $ikey_ex) <> $default_key)
IF (writevalue($ikey, $ikey_ex, $default_key, $result_data_type) = 0)
IF (writevalue($ikey, $ikey_ex, $default_key, "REG_SZ") = 0)
ENDIF
ENDIF
$info=$info+" "+$ikey+"="+$default_key
ENDIF
;
IF ($debug_mode = "yes")
? $info
ENDIF

Complete things are written in:

http://kixtart.org/script/board/ubbhtml/Forum2/HTML/000534.html

Greetings.

_________________________
email scripting@wanadoo.nl homepage scripting@wanadoo.nl | Links | Summary of Site Site KiXforms FAQ kixtart.org library collection mirror MCA | FAQ & UDF help file UDF kixtart.org library collection mirror MCA | mirror USA | mirror europe UDF scriptlogic library collection UDFs | mirror MCA

Top
#2799 - 2000-06-20 06:52 PM Re: Complete FIX for all variations of "VBS/LoveLetter.worm" virus.
MCA Offline
KiX Supporter
*****

Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
script also protecting against VBS.Stage.A
_________________________
email scripting@wanadoo.nl homepage scripting@wanadoo.nl | Links | Summary of Site Site KiXforms FAQ kixtart.org library collection mirror MCA | FAQ & UDF help file UDF kixtart.org library collection mirror MCA | mirror USA | mirror europe UDF scriptlogic library collection UDFs | mirror MCA

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2220 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.059 seconds in which 0.03 seconds were spent on a total of 12 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org