Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Description of your first forum.

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Erik, Sofia, Flopsy and Zo » Thu, 04 Apr 2002 07:49:51



Do not open the message (most antivirus programs will alert you). It is an
HTML posting with a malicious script that tries to access your email ...

Erik, Sofia, Flopsy and Zo?

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Nona » Thu, 04 Apr 2002 08:31:16


Erik,

Can you tell us how to check to see if it is on board?  Or has done any
damage.

It crashed me, and I have Norton Antivirus.

Nona


Quote:

> Do not open the message (most antivirus programs will alert you). It is an
> HTML posting with a malicious script that tries to access your email ...

> Erik, Sofia, Flopsy and Zo?

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Nona » Thu, 04 Apr 2002 08:35:26


Answered my own question, I hope, if JS Loop it is.

http://hq.mcafeeasap.com/dispTrojan.asp?virus_k=99220

for others who want answers.

Nona


Quote:

> Do not open the message (most antivirus programs will alert you). It is an
> HTML posting with a malicious script that tries to access your email ...

> Erik, Sofia, Flopsy and Zo?

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Erik, Sofia, Flopsy and Zo » Thu, 04 Apr 2002 08:42:38


I was not completely right, but then again, neither was my Norton Antivirus.
What happens is that the posting contained some javascript that supposedly
pops up a quasi funny message upon opening the post (or previewing it in
your preview window, which is the same thing basically). Norton started to
halt the javascript code saying that the virus attempted to access my
Outlook (which is my mail handler, not Outlook Express). I denied access to
Outlook, and wrote the message in the newsgroup - not as a reply to the
original message but as a new posting so it would be more obvious to the
readers as they download the threads.

Anyway, closer inspection revealed the code used by our funny troll:

function cloudbuster()
{
   while (true)
       window.alert("** WARNING ** VirusScan has detected the
ALT.MAG.PLAYBOY virus on your hard drive. If you have recently opened an
email or newsgroup message and see this alert your system is infected.")

Quote:
}

And you don't need to be a programming expert to see what this does and the
message it pops up. Funny enough the responses on some of the workstations
were different (perhaps depending on the version of Norton) - in any case it
is annoying to post HTML in a message, even more so when it contains code
(like this). It can be a nuisance, it can be potentially dangerous. In this
case it was a nuisance. There is no record of email sent (though this is the
common action for this kind of malicious code).

My advise to all is:

- make sure you have the latest version of your email reader
- make sure you have installed all patches, service updates etc. from
windows (or any other OS)
- make sure you have a good, and up-to-date antivirus program (invest in
this! a couple of bucks per year is going to make the difference sooner or
later for everyone!).
- never open suspicious emails, messages, etc - and use filters if you can

Erik and Sofia, with Flopsy and Zo? (annoyed for having to wait for their
food).

Quote:

> Erik,

> Can you tell us how to check to see if it is on board?  Or has done any
> damage.

> It crashed me, and I have Norton Antivirus.

> Nona


> > Do not open the message (most antivirus programs will alert you). It is
an
> > HTML posting with a malicious script that tries to access your email ...

> > Erik, Sofia, Flopsy and Zo?

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Nona » Thu, 04 Apr 2002 08:54:26


Thanks, guys (and gals and bunnies).

Nona


Quote:

> I was not completely right, but then again, neither was my Norton Antivirus.
> What happens is that the posting contained some javascript that supposedly
> pops up a quasi funny message upon opening the post (or previewing it in
> your preview window, which is the same thing basically). Norton started to
> halt the javascript code saying that the virus attempted to access my
> Outlook (which is my mail handler, not Outlook Express). I denied access to
> Outlook, and wrote the message in the newsgroup - not as a reply to the
> original message but as a new posting so it would be more obvious to the
> readers as they download the threads.

> Anyway, closer inspection revealed the code used by our funny troll:

> function cloudbuster()
> {
>    while (true)
>        window.alert("** WARNING ** VirusScan has detected the
> ALT.MAG.PLAYBOY virus on your hard drive. If you have recently opened an
> email or newsgroup message and see this alert your system is infected.")
> }

> And you don't need to be a programming expert to see what this does and the
> message it pops up. Funny enough the responses on some of the workstations
> were different (perhaps depending on the version of Norton) - in any case it
> is annoying to post HTML in a message, even more so when it contains code
> (like this). It can be a nuisance, it can be potentially dangerous. In this
> case it was a nuisance. There is no record of email sent (though this is the
> common action for this kind of malicious code).

> My advise to all is:

> - make sure you have the latest version of your email reader
> - make sure you have installed all patches, service updates etc. from
> windows (or any other OS)
> - make sure you have a good, and up-to-date antivirus program (invest in
> this! a couple of bucks per year is going to make the difference sooner or
> later for everyone!).
> - never open suspicious emails, messages, etc - and use filters if you can

> Erik and Sofia, with Flopsy and Zo? (annoyed for having to wait for their
> food).


> > Erik,

> > Can you tell us how to check to see if it is on board?  Or has done any
> > damage.

> > It crashed me, and I have Norton Antivirus.

> > Nona


> > > Do not open the message (most antivirus programs will alert you). It is
> an
> > > HTML posting with a malicious script that tries to access your email ...

> > > Erik, Sofia, Flopsy and Zo?

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Keith Kell » Thu, 04 Apr 2002 09:30:01




[snip]

Quote:
> My advise to all is:

> - make sure you have the latest version of your email reader

--And news reader!

Quote:
> - make sure you have installed all patches, service updates etc. from
> windows (or any other OS)

--And get a good OS.  :)

Quote:
> - make sure you have a good, and up-to-date antivirus program (invest in
> this! a couple of bucks per year is going to make the difference sooner or
> later for everyone!).

--Or get a good OS.

Quote:
> - never open suspicious emails, messages, etc - and use filters if you can

--Or get a good mail and/or newsreader on a good OS.

Self-righteously yours,

--keith  :)

--

public key:  http://wombat.san-francisco.ca.us/kkeller/public_key
alt.os.linux.slackware FAQ:  http://wombat.san-francisco.ca.us/perl/fom

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Nona » Thu, 04 Apr 2002 09:35:23


Thank you, Keith.  When you're right, you're right.

Is there a site that the adventurous among us can go to to learn about
running dual OSs?  For those of us who have to have that unmentionable
OS?

Nona

Quote:



> [snip]
> > My advise to all is:

> > - make sure you have the latest version of your email reader

> --And news reader!

> > - make sure you have installed all patches, service updates etc. from
> > windows (or any other OS)

> --And get a good OS.  :)

> > - make sure you have a good, and up-to-date antivirus program (invest in
> > this! a couple of bucks per year is going to make the difference sooner or
> > later for everyone!).

> --Or get a good OS.

> > - never open suspicious emails, messages, etc - and use filters if you can

> --Or get a good mail and/or newsreader on a good OS.

> Self-righteously yours,

> --keith  :)

> --

> public key:  http://wombat.san-francisco.ca.us/kkeller/public_key
> alt.os.linux.slackware FAQ:  http://wombat.san-francisco.ca.us/perl/fom

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by biskyb.. » Thu, 04 Apr 2002 10:00:27



Quote:


> [snip]
> > My advise to all is:

> > - make sure you have the latest version of your email reader

> --And news reader!

I *heart* trn.

Quote:
> > - make sure you have installed all patches, service updates etc. from
> > windows (or any other OS)

> --And get a good OS.  :)

And which one might that be, sir?

Quote:
> > - make sure you have a good, and up-to-date antivirus program (invest in
> > this! a couple of bucks per year is going to make the difference sooner or
> > later for everyone!).

> --Or get a good OS.

> > - never open suspicious emails, messages, etc - and use filters if you can

> --Or get a good mail and/or newsreader on a good OS.

> Self-righteously yours,

> --keith  :)

*grin*

laura

--
http://samspade.org/
Because the global village has more than its fair share of idiots.

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Keith Kell » Thu, 04 Apr 2002 15:28:35




Quote:
> Thank you, Keith.  When you're right, you're right.

> Is there a site that the adventurous among us can go to to learn about
> running dual OSs?  For those of us who have to have that unmentionable
> OS?

OS/2?  ;-)

For the OS I use, try http://www.linux.org/docs/beginner/index.html
For other non-sucky OSes, these may or may not help:

http://www.freebsd.org/
http://www.netbsd.org/
http://www.apple.com/macosx/

There are gobs of other docs on the web that can help you upgrade
from Windows or Mac OS < X, and many different newsgroups, too.
(Some of which make alt.pets.rabbits posters look positively polite
in comparison.)

--keith

--

public key:  http://wombat.san-francisco.ca.us/kkeller/public_key
alt.os.linux.slackware FAQ:  http://wombat.san-francisco.ca.us/perl/fom

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Dom-n-Minn » Fri, 05 Apr 2002 05:16:02



Quote:

> For other non-sucky OSes, these may or may not help:
> http://www.apple.com/macosx/

;-)

Quote:
>  many different newsgroups, too.
> (Some of which make alt.pets.rabbits posters look positively polite
> in comparison.)

Techno geeks are the most abominable form of life, the absolute lowest of
the low.
:)

D'n'M

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Keith Kell » Fri, 05 Apr 2002 08:40:40




Quote:
> Techno geeks are the most abominable form of life, the absolute lowest of
> the low.
>:)

Oy!  Pot-kettle-black!  :)  At least we'll be in high demand when
the computers rebel a la Terminator.  I wonder if rabbits can also
sniff out Terminator units?  If our Tina ever gets a whiff of one,
my money's on Tina.

--keith

--

public key:  http://wombat.san-francisco.ca.us/kkeller/public_key
alt.os.linux.slackware FAQ:  http://wombat.san-francisco.ca.us/perl/fom

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Nona » Fri, 05 Apr 2002 15:14:19


Quote:

> and many different newsgroups, too.
> (Some of which make alt.pets.rabbits posters look positively polite
> in comparison.)

What?!! We *are* polite! (mostly!)

N

 
 
 

Virus in newsgroup: message with title CloudBuster Busted contains JS.Loop virus

Post by Penny Levesqu » Mon, 08 Apr 2002 09:35:59


HI, This person has been going to every news group possible.Sometimes the
header is Tgos,Cloudbuster, Corupter and one titled Virus Warning.It's not a
virus just a pain in the you know what!  Sorry to get off topic,can anyone
tell if you should trim bunny claws.My Bugsy's are very damaging to
everything including me.:)    Thanks Regards Penny
Quote:

> Erik,

> Can you tell us how to check to see if it is on board?  Or has done any
> damage.

> It crashed me, and I have Norton Antivirus.

> Nona


> > Do not open the message (most antivirus programs will alert you). It is
an
> > HTML posting with a malicious script that tries to access your email ...

> > Erik, Sofia, Flopsy and Zo?