the statement that "In any event, users who don't accept executables (files ending in the suffix .exe) from strangers are safe from the Trojan," is completely untrue. malicious scripts could be executed via windows scripting host (*.vbs or *.wsh files) thereby forcing virtually any command to be run on the host's computer. the infamous love bug consisted of only a script that automatically downloaded a virus off the net and executed it on reboot. in fact, there are several file types, such as *.com files that pose a major threat (*.vbs being a bit more subtle).

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/171/4927#4927