ProcessLibrary.com has grown to become the definitive reference point for anyone who needs comprehensive information on these processes. Explanations are accompanied by exhaustive advice on whether the processes are important for the stable and secure running of your system. The website also recommends if you should terminate processes or leave them untouched.
ProcessLibrary.com already offers users its very own ProcessQuickLink that installs as a plug-in to the existing Windows Task Manager. This provides users with an information button next to each process running on their computer. The button activates a direct link to ProcessLibrary.com, and will provide relevant information, specific to the process, instantly in a new browser window. From November 2007 ProcessLibrary.com will be even better with substantial improvements added to its already impressive features. These include:
With these improvements, ProcessLibrary.com will continue to remain the definitive industry reference point for all PC users.
Analysis of the LOVE-LETTER-FOR-YOU virus/worm
------------------------------------------------------------------------------------------------
The virus/worm hit Belgium and the rest of the world on Thursday 15/04/2000. A lot of important
companies were struck including banks, factories and my dads work :).That's where I got the
little bugger. The virus/worm is a big vbscript that spreads by email (smells like Melissa :))
and infects every script on your computer.
Lifecycle
------------------------------------------------------------------------------------------------
All starts by opening an attachment on an email, then the script starts.
It copies itself into:
$windir/Win32DLL.vbs ($windir = c:\windows on most windows systems)
$systemdir/MSKernel32.vbs ($systemdir = c:\windows\system)
$windir/LOVE-LETTER-FOR-YOU.TXT.vbs
Next it adds those files in the registry so they auto-start on boot.
After that it changes the default page of internet explorer, that way it downloads an executable
from a site when IE opens. If the file has already been downloaded it also adds that into the
registry and changes the default page to "about:blank".
Then it starts sending emails with the script attached to all the people in your addresslist
Finally the big mess starts, the virus scans every harddisk and networkdisk for extentions:
Vbs, vbe, js, jse, css, wsh, sct, hta, vbs, jpg, jpeg
All files found are overwritten by the virus and when mp2's or mp3's are found it copies itself
to a vbs script in the same directory. And when mIRC is found a small mIRC script is created
which sends an html page, which tries to infect you using IE, to every user that joins a channel
you're in.
EXE
------------------------------------------------------------------------------------------------
It cracks the share passwords and sends those + ipaddr by email to the creator of this virus
(I couldn't get this program because the server was shutdown, thanks to G0Dfarter for checking it)
Disinfection
------------------------------------------------------------------------------------------------
Open regedit and start deleting the malicious entries
HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run\MSKernel32
HKEY_HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\RunServer\Win32DLL
HKEY_HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run\WIN_BUGSFIX
Search for WIN-BUGSFIX.exe and remove it.
Remove $dirsystem\LOVE-LETTER-FOR-YOU.HTM
Check files with extensions: Vbs, vbe, js, jse, css, wsh, sct, hta, vbs, jpg, jpeg and check for
infection, if so delete them (and replace them with the original).
If you have mIRC is installed remove the script.ini file.
Remove all the emails, maybe warn the people in your addresslist so they don't open the attachment.
Prevention
------------------------------------------------------------------------------------------------
There is only 1 rule in these cases: do NOT open suspicious files
The number one cause why this virus is so affective is that in windows everything is linked.
You can control your entire computer from a simple wordmacro (and worst).
The best thing to do is turn off all sorts of scripting in windows (if possible).
Needsome professional viruses, like melissa -- i love you -- contact me.
When you log on to a non-genuine copy of Windows XP, the following notification error message "This copy of Windows is not genuine" will pop-up on the logon process.
And the nicely said "You may be victim of software counterfeiting" message on the bottom right corner of log-in screen.
Microsoft allows WIndows faithfuls to have 2 options: Get Genuine or Resolve Later. Click on Resolve Later will temporarily bypass the notification and let you login into and use Windows nagged with notification icon and messages, which will randomly appear as balloon notification message with an icon in the notification area (system tray).
Clicking on the balloon notification or the notification area icon will lead you to the Windows Genuine Advantage Validation Failure Web page that contains the specifics of the validation failure and the steps that you can take to make the operating system genuine.
