ProSam
01-18-2002, 03:38 AM
All my .jpg files all of a sudden have a .vbs extention on them.
I think I heard this somewhere.
If it is how do I fix it?
And how did I get it?
I'm using Win2k and have different users setup, only two of the users have permission to download. Both of them say they haven't downloaded anything, let alone run anything that has been downloaded.
One perculiar thing I've noticed is that I had my homepage set to about:blank and all of a sudden my homepage is automatically trying to download some type of bug fix. What the hell is this? I asked all my users and none of them know what I'm talking about. I've set the homepage back to about:blank and when I open up the browser again it downloading again, back to the other homepage.
I need help here people, I work with jpg's a lot as a graphica and web designer and it is essential I fix this.
PLEASE HELP, I BEG OF YOU!:bawling:
MarcD
01-18-2002, 04:09 AM
yes thats the love letter virus here is the symantec link
for fixes
http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html
Originally posted by ProSam
All my .jpg files all of a sudden have a .vbs extention on them.
I think I heard this somewhere.
If it is how do I fix it?
And how did I get it? It actually could be any number of worm/virus variants; the most recent widely distributed one was BadTrans. As for how you got it, probably as an email attachment. You use Outlook to read email, I'd guess...
http://www.webhostingtalk.com/showthread.php?threadid=27177&perpage=15&pagenumber=2
In the second message on that page is a link to Microsoft's website; you might need that patch.
ProSam
01-18-2002, 04:31 AM
BUt the thing is I don't remember ever downloading any fiiles from the internet.
I went back and checked all my recent email and deleted email and nothing. And I have stuff in my deleted folder from December. This just started happening today.
The only thing I've downloaded recently was something I sent myself from work from another email account. It was a word document. Is it possible it attached it self to it? Even though I have not even opened the file yet.
I also don't run IE5, I run IE6. So I think that patch does not pertain to me.
Will I be able to fix this?
I will die if I can't fix this.:bawling:
VhatDaFruit
01-18-2002, 05:00 AM
It's probably your users. You don't have to open anything to run some of these viruses. They just open themselves in the preview pane.
ProSam
01-18-2002, 05:12 AM
OKay I downloaded the fix and the bug was detected and eliminated.
Now what I want to know is how to fix all my jpg files.
Have any ideas?
Originally posted by ProSam
Now what I want to know is how to fix all my jpg files.
Have any ideas? Unfortunately if it's LoveLetter or one of its variants the affected files are overwritten, usually with the virus code. They have the original name with a .vbs extension like filename.jpg.vbs but are not your .jpg files any more -- they are .vbs files with the virus code, so if you execute them it will reinstall.
The only safe way to proceed is to delete them and... you know... restore your backup.
Sorry, couldn't resist.. :(
ProSam
01-18-2002, 02:47 PM
DAMN!!!
This really sucks.
I had never been hit by a virus. I guess I should be happy it was not a really bad one.
Anyways I feel better cuz I remembered all my most important files are backedup on disk and the most recent are residing on my host servers. So all I have to do is download them to my pc.
What have I learned from this experience?
Don't let anybody use my computer.:D
And always use an anti-virus.
I thought I would be smart enough to catch the virus and delete it but this was a wake up call.
Thanks for the help guys.