Virus Infection of iPlanet(tm)Process Manager 6.0 Graphical Images

This technical note contains important information about graphical image files accompanying iPlanet™ Process Manager 6.0 for Solaris.

Electronic images contained in the Solaris version of the iPlanet Process Manager 6.0 documentation files released by iPlanet in the spring of 2000 via CD and internet download are corrupted by the VBS/LoveLetter computer virus. Activating the virus on Microsoft Windows can damage your computer files and can cause the virus to spread via email to other computers, in certain situations.

Running the iPlanet Process Manager 6.0 software will not damage your computer files. Users would have to run the actual corrupted files to cause damage. Due to the fact that the corrupted files are in the Solaris version only, and that the virus can be activated only on Windows platforms, iPlanet believes the likelihood is low that a user of the Process Manager 6.0 software will activate the virus and cause the type of damage described above.

Regardless, if you are in possession of CDs containing the iPlanet Process Manager version 6.0 software, please do not install this software on your computer, and please discard these CDs. If you obtained the software via download prior to October 9, 2000 please do not install this software, and please delete the software from any computers where it may reside.

If you have already installed the software, please read below for information on how to delete the infected files from your computer.

For technical support in dealing with this virus issue, please visit www.iplanet.com/support/ or call the 800 number listed in your maintenance contract.

Please read the remainder of this technical alert for more information on the following topics:

· How to Avoid Activating the Virus

· List of Corrupted Files

· What the Virus Does

· How to Remove the Corrupted Files

· How to Obtain Replacement iPlanet Process Manager 6.0 Software

· How to Clean Your System if You Have Activated the Virus

· More Information About the Virus

How to Avoid Activating the Virus

The virus can be activated only by running the infected files on a computer running the Microsoft Windows operating system. The virus cannot be activated on a computer running the Solaris operating systems.

To ensure that you do not activate the virus, follow these guidelines:

· Don't open the Solaris version on Microsoft Windows platforms.

· Don't interact in any way (other than to delete without opening) any Process Manager files which end in the suffix .vbs.
 
 

List of Corrupted Files

The corrupted documentation graphical image files are located in the following directories:

<install_directory>/ias/docs/C++ProgGuides//images/trans.gif.vbs

<install_directory>/ias/docs/JavaProgGuides//images/trans.gif.vbs

<install_directory>/ias/docs/ReleaseNotes/ipbr.jpg.vbs

<install_directory>/ias/docs/install//images/trans.gif.vbs

<install_directory>/ias/docs/migrate//images/trans.gif.vbs

<install_directory>/ias/docs/overview//images/trans.gif.vbs

What the Virus Does

Solaris Platforms

If you have installed the Solaris version of the software and are viewing the online documentation, a blank square appears in the upper left hand corner of the screen where the iplanet logo would otherwise appear. This is a result of the corruption of the above mentioned six files which contain the iPlanet logo. This is the extent of the problem that could be caused by the virus on the Solaris operating system.

Microsoft Windows Platforms

If you have installed the Windows version of the software, this problem of the missing iPlanet logos will not occur, provided you have not manually opened the six specific infected files mentioned above (in the Solaris version of the product).

Do not manually open the six specific infected documentation files mentioned above. If you do so, the virus will corrupt files of type ".jpg", ".jpeg", ".mp3", and ".mp2", and send copies of itself to other computers via the Microsoft Outlook application.

For more details on these and other effects, and for information on how the virus operates, see More Information About the VBS/Loveletter Virus.

How to Remove the Corrupted Files

If the Solaris version of the software is on a Microsoft Windows system, delete the entire Solaris version. 
If the software is on a Solaris system, find the corrupted files as described above, and then delete them.

A replacement copy of the software can be downloaded from the iPlanet Product Tracker service http://www.iplanet.com/support/online/product_tracker/.

How to Clean Your System if You Have Activated the Virus

Users can manually remove the VBS/LoveLetter virus by deleting the following files from the infected machine:

· All "*.VBS" files from all drives and all subdirectories.

· The file LOVE-LETTER-FOR-YOU.HTM from the Windows System directory.

· WIN-BUGSFIX.EXE and WINFAT32.EXE from the Internet Explorer download directory.

· If you are using mIRC, delete the "script.ini" file from the mIRC installation directory.

Users can disable execution of vbs scripts by removing the VBS association, as follows:

Numerous Internet sites contain more information about the VBS/LoveLetter Virus. One site you can consult is:

http://www.datafellows.com/v-descs/love.htm