Britney.jpg Virus clone detected as Jenna_Jameson.jpg

Hollowpoint · 11-01-2003, 05:30 PM

http: //www.angelf ire.com/az3/pic sxxx/jenna_ jame son.jpg

(URL broken up to prevent accidental clickage)

looks like another nasty data destroying program being advertised.

This was a global advert on Quakenet today

-O- (Broadcast) QuakeNet would like to remind all its windows using users NOT TO CLICK ON ANY LINKS THEY SEE ON IRC. This particularly refers to any links ending in .jpg, such as jenna_jameson.jpg, as they will destroy the data stored on your computer.

Looking at the worm code, its a duplicate of the Britney.jpg worm circulating last week.

The cure is still the same.

-------------------------- CURE ------------------------
if you're infected..use this to remove the worm | //unload -rs script.ini | write -c script.ini | remove script.ini | run command.com /c attrib.exe -r mirc.ini | ignore -r | note that the worm removes your system32/ntoskrnl.exe so don't reboot if you're infected

more info here
http://koti.phnet.fi/jonninen/mircworms/britny.txt

--------------------- GOOD NEWS --------------------
I emailed the AF team, and they killed the account in 2 minutes.
I shall also be sending a few copies to various AntiVirus specialists, to make sure virus patterns are updated.

Hollowpoint · 11-01-2003, 06:05 PM

-------------- DETECTION -----------------------

Scan your pc for userinit32.exe
If it doesn't exist, you are clean
If it does, DON'T reboot
The virus stops you booting your pc, so you will need to re-install windows

If you are in IRC atm paste this in:
$false
If you get $false posted it ok, youre clean!
CHECK OUT THIS LINK FOR MORE INFO
http://securityresponse.symantec.com...rojan.fgt.html

Pasty901 · 11-01-2003, 08:32 PM

This 1 is much nastier than Britney! Every1 be very careful - click on it and u aint comin back! (without a reinstall)

**greffov** · 11-02-2003, 03:35 PM

Quote:

This 1 is much nastier than Britney!

All remember Jenna Jameson from her first movie? (Blue Movie) For those who don't:

http://www.jennasextoys.com/detail.c...512&Cat=VIDEOS
http://excaliburfilms.com/AdultDVD/blue_movie.htm
http://www.cnv.com/MoviesJennajameson/WIC60012.html

It's always good to know who is threatening you this time...

11-01-2003, 05:30 PM	#1 (permalink)
Hollowpoint Registered User Join Date: Jan 2003 Location: a small molecule called earth in a vast blood system called the universe surrounded by a heavenly body... maybe Posts: 108	Britney.jpg Virus clone detected as Jenna_Jameson.jpg http: //www.angelf ire.com/az3/pic sxxx/jenna_ jame son.jpg (URL broken up to prevent accidental clickage) looks like another nasty data destroying program being advertised. This was a global advert on Quakenet today -O- (Broadcast) QuakeNet would like to remind all its windows using users NOT TO CLICK ON ANY LINKS THEY SEE ON IRC. This particularly refers to any links ending in .jpg, such as jenna_jameson.jpg, as they will destroy the data stored on your computer. Looking at the worm code, its a duplicate of the Britney.jpg worm circulating last week. The cure is still the same. -------------------------- CURE ------------------------ if you're infected..use this to remove the worm \| //unload -rs script.ini \| write -c script.ini \| remove script.ini \| run command.com /c attrib.exe -r mirc.ini \| ignore -r \| note that the worm removes your system32/ntoskrnl.exe so don't reboot if you're infected more info here http://koti.phnet.fi/jonninen/mircworms/britny.txt --------------------- GOOD NEWS -------------------- I emailed the AF team, and they killed the account in 2 minutes. I shall also be sending a few copies to various AntiVirus specialists, to make sure virus patterns are updated. __________________ <anamexis> oh man <anamexis> I was opening a coke, right --> Beefpile (~mbeefpile@cloaked.wi.rr.com) has joined #themacmind <anamexis> and it exploded <anamexis> ALMOST all over my keyboard <anamexis> but I got it away just in time <-- Beefpile has quit (sick ****ers) <anamexis> :<

11-01-2003, 06:05 PM	#2 (permalink)
Hollowpoint Registered User Join Date: Jan 2003 Location: a small molecule called earth in a vast blood system called the universe surrounded by a heavenly body... maybe Posts: 108	-------------- DETECTION ----------------------- Scan your pc for userinit32.exe If it doesn't exist, you are clean If it does, DON'T reboot The virus stops you booting your pc, so you will need to re-install windows If you are in IRC atm paste this in: $false If you get $false posted it ok, youre clean! CHECK OUT THIS LINK FOR MORE INFO http://securityresponse.symantec.com...rojan.fgt.html __________________ <anamexis> oh man <anamexis> I was opening a coke, right --> Beefpile (~mbeefpile@cloaked.wi.rr.com) has joined #themacmind <anamexis> and it exploded <anamexis> ALMOST all over my keyboard <anamexis> but I got it away just in time <-- Beefpile has quit (sick ***ers) <anamexis> :< Last edited by Hollowpoint; 11-01-2003 at 06:36 PM.*

11-01-2003, 08:32 PM	#3 (permalink)
Pasty901 News Writer! Join Date: Nov 2002 Location: United Kingdom Posts: 785	This 1 is much nastier than Britney! Every1 be very careful - click on it and u aint comin back! (without a reinstall) __________________ "The hardest thing in this world is to live in it."

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode