Forum Archive Index - December 2001

["hugh webber" <hugh.webber@clear.net.nz>]

Having been inadvertently infected by a relative in Australia (you can't trust 
anyone or any
messages) I thought I'd post this one as it seems to be particularly dangerous 
and quite different
in kind from previous ones which nearly always seem to work through an 
attachment. I expect it will
evolve so that potentially anyone from sharechat sending you a site reference 
to business/shares
discussion at an Internet site may be infecting you. Or a friend sending you a 
genealogical site
reference. 
I've got to the stage where I'm being ultra cautious and twitchy and confirming 
with the sender
before I open or click on anything. It takes time for some of these to be 
noticed and have fixes -
why be the pioneer who catches it.

cheers,
Hugh

JS.CoolSite-A

The format of the message is as follows:

   Subject: Hi!!

   Body: Hi. I found cool site! http://<address omitted> It's really cool!

Note - these details are suppressed for copying

When the recipient clicks on the hypertext link, their browser is
exploited, sending a message to all recipients in their address book.  The
start page in Internet Explorer will also be reset to a pornographic site.

So, this one is a virus that bears no attachment. The website is likely to
have been closed down, but this technique demonstrates how easy it is to
exploit unpatched security vulnerabilities.

Details about the worm here:
http://www.symantec.com/avcenter/venc/data/pf/js.coolsite@mm.html



----------------------------------------------------------------------------
To remove yourself from this list, please use the form at
http://www.sharechat.co.nz/chat/forum/