JS.Fortnight
Description JS.Fortnight
JS.Fortnight is an Internet worm that uses infected emails with hidden links to an Internet Web page from which it downloads its infected code.
Infected messages contain a hidden link to a Web page containing the worm. When a user opens an infected email message the link opens and downloads the worm's body and executes it in a hidden frame.
The worm uses the Microsoft VM ActiveX security vulnerability for which Microsoft released a security patch three years ago. This allows the worm's code to be executed on the local (victim) computer.
More information about this vulnerability and the patch for it is available at:
http://www.microsoft.com/technet/security/bulletin/ms00-075.asp
The Fortnight worm uses a cookie named "TF" to mark infected computers. If this cookie is absent it changes the Internet Explorer default Web page address to a pornographical site.
Next the worm copies the default signature of Outlook Express 5.0 to the file C:Program Filessign.htm with the link added to its body. All messages sent later from an infected computer contain this link.
The Fortnight worm creates 3 links in the "Favorites" folder:
"SEXXX. Totaly Teen.url"
"Make BIG Money.url"
"6544 Search Engines Submission.url"
Fortnight installs two cookies that act as infection marks.
The site that contained the worm's body was blocked as soon as the worm appeared in the wild and is still down.
I-Worm.JS.Fortnight.f
The Fortnight.f worm creates 3 links in the "Favorites" folder:
"Nude Nurses.url"
"Search You Trust.url"
"Your Favorite Porn Links.url."
Check other viruses! Be aware! Use Antiviral Software
Ooops.368
Description Ooops.368
It is a dangerous nonmemory resident overwriting virus. It searches for .COM files of the current directory and overwrites them. It erases FAT of current drive and displays:
Ooops.. I've managed to erase your File Allocation Tablesall
Good thing I made a copy of them... now where did I put those damn things?
Oops.600
Description Oops.600
It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. Depending on the system date it renames C:COMMAND.COM file to C:COMMAND.BAD, it displays the messages:
Bad command or file name
_____________________________________
__ Oops! Sorry for BAD virus! __
_____________________________________
|