klopt inderdaad. het lijkt wel een copy van I love you maar is het niet, alhoewel het wel gebruik maakt van dezelfde exploits...
wat hij exact doet: (onder voorbehoud)
VBS.Stages.A
By Lenny Vinson lvinson@cosaint.com for SecurityPortal.com
Summary
Common Names: VBS.Stages.A.
Aliases: IRC.Stages.worm, Life_Stages Worm, I-Worm.Scrapworm, IRC/Stages.ini, Life_Stages.TXT.SHS, ShellScrap Worm, VBS/Lifestages, VBS/Stages.14558, VBS/Stages.2541
Type: Visual Basic Script Worm
Author: Unknown
Discovered: 06/16/2000
Origin: Unknown
Risk: High
Damage: Low
Distribution: High
Vulnerable: Windows 95/98/NT/2000
Brief
VBS.Stages.A is usually received as an email attachment Life_Stages.Txt.SHS. When opened this attachment will launch Notepad and display the following text:
The male stages of life:
Age.Seduction lines.
17 My parents are away for the weekend.
25 My girlfriend is away for the weekend.
35 My fiancee is away for the weekend.
48 My wife is away for the weekend.
66 My second wife is dead.
Age. Favorite sport
17 Sex.
25 Sex.
35 Sex.
48 Sex.
66 Napping.
Age. Definition of a successful date.
17 Tongue
25 Breakfast.
35 She didn't set back my therapy.
48 I didn't have to meet her kids.
66 Got home alive.
The female stages of life.
Age. Favorite fantasy
17 Tall, Dark and handsome.
25 Tall, Dark and handsome with money.
35 Tall, Dark and handsome with money and a brain
48 A man with hair
66 A man
Age.Ideal date. 17 He offers to pay.
25 He pays.
35 He cooks breakfast the next morning.
48 He cooks breakfast the next morning for the kids.
66 He can chew his breakfast
If the file "LIFE_STAGES.TXT.SHS" is run, the following will occur on the local system:
1) Extracts "LIFE_STAGES.TXT.VBS" and runs from the temp folder
2) Sends itself via MAPI email to a random number of recipients with one of the following email combinations:
Subject: [P1]+[P2]+[P3]
Body: > The male and female stages of life.
Attachment: LIFE_STAGES.TXT.SHS
In the above, the subject line is variable, but limited to 12 possible combinations. P1, P2 & P3 are chosen from the respective lists below:
P1 -» "FW: ", ""
P2 -» "Life stages", "Funny", "Jokes"
P3 -» " text", ""
Examples:
Subject = "Funny"
Subject = "FW: Jokes text"
Subject = "Life stages"
The recipients are "blind carbon copied" or "bcc".
* moves REGEDIT.EXE from the Windows folder to the recycle bin as "RECYCLED.VXD", modifies registry to use this relocated file when importing or using registry type files
3) Creates files of random names throughout the local system and all available drives; fixed names include the following:
c:\WINDOWS\SYSTEM\MSINFO16.TLB
c:\WINDOWS\SYSTEM\SCANREG.VBS
c:\WINDOWS\SYSTEM\VBASET.OLB
c:\RECYCLED\DBINDEX.VBS
c:\RECYCLED\MSRCYCLD.DAT
c:\RECYCLED\RCYCLDBN.DAT
c:\RECYCLED\RECYCLED.VXD (really REGEDIT.EXE)
The following are examples of random names generated:
c:\report.txt.shs
c:\My Documents\IMPORTANT.TXT.SHS
c:\WINDOWS\LIFE_STAGES.TXT.SHS
c:\WINDOWS\Start Menu\Programs\unknown_805.txt.shs
In the creation of random named SHS files, this worm uses the following algorithm to determine a name:
([Random1]+[Random2]+[Random3])+TXT+SHS.
Random1 is a selection of one of five choices:
"IMPORTANT"
"INFO"
"REPORT"
"SECRET"
"UNKNOWN"
Random2 is a selection of one of two choices:
"-"
"_"
Random3 is a randomly generated number between 0 and 999.
The combination of these three randomizations results in 10,000 possible different names.
4) Modifies the registry to run SCANREG.VBS at Windows startup
5) Modifies the registry to run DBINDEX.VBS when loading ICQ
6) Modifies the registry to run RECYCLED.VXD when calls are made to run REGEDIT type files
7) Modifies MIRC.INI to load an auxiliary script file for PIRCH/mIRC installations
Creates SOUND32B.DLL whenever Windows restarts in the Windows folder via SCANREG.VBS; SOUND32B.DLL is an auxiliary script file called by MIRC.INI; SOUND32B.DLL contains instructions to send the file LIFE_STAGES.TXT.SHS when connecting to IRC channels
9) Modifies the following registry settings (to recover, modify these to original "from" settings):
HKLM\Software\CLASSES\regfile\DefaultIcon
Value "@":
from "C:\WINDOWS\regedit.exe,1"
to "C:\RECYCLED\RECYCLED.VXD,1"
HKLM\Software\CLASSES\regfile\shell\open\command
Value "@":
from "regedit.exe "%1""
to "C:\RECYCLED\RECYCLED.VXD "%1""
10) Creates the following registry settings (to recover, delete these keys):
HKU\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\
Parameters="C:\RECYCLED\DBINDEX.VBS"
HKU\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\
Path="C:\WINDOWS\WSCRIPT.EXE"
HKU\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\
Startup="C:\WINDOWS"
HKLM\Software\CLASSES\txtfile\
AlwaysShowExt=""
HKLM\Software\Microsoft\Windows\CurrentVersion\
OSName="Microsoft Windows"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
ScanReg="C:\WINDOWS\WSCRIPT.EXE C:\WINDOWS\SYSTEM\SCANREG.VBS
raarste is eigenlijk nog wel dat hij niet zomaar de hele lijst met adressen afwerkt. Hij selecteerd volledig random adressen waarna hij ze bcc verstuurt.
anyway: code zag er professioneler uit dan ILOVEYOU... (damn, deze topic is laaaang
)
Paz
)
zou mijn actie toch nog ergens goed voor zijn geweest.
brakke wetgeving? Dacht het wel. 
Tik "C:\WINDOWS\NOTEPAD.EXE" "%1" in het 'application used to preform action' edit boxje.
