check for download.ject

[emmanuel]

After reading MS's site on download.ject I wrote this script to check for the virus.

it's simple, but might help others who are wondering, like I am, if work has decided to do anything about checking for this one.

;check for ject
$kk32 = runwait(@comspec & " /c dir /a /s /b %systemdrive%\kk32.dll",@SystemDir, @SW_HIDE)
$surf = runwait(@comspec & " /c dir /a /s /b %systemdrive%\surf.dat",@SystemDir, @SW_HIDE)
$msg = "You PC doesn't appear to be infected with Download.Ject" & @LF
if $kk32 = 1 then  $msg = $msg &@TAB &"kk32.dll not found (this is good)" & @LF   
if $surf = 1 then $msg = $msg &@TAB& "surf.dat not found (this is good)" & @LF
$msg = $msg & "You should still be certain to download all updates from windowsupdates.com and follow MS's other security steps."
if $kk32 =0 or $surf =0 Then
   MsgBox(0,"get help","You're infected, get help now.  This probably means running a virus scan and calling IT")
Else
   MsgBox(0, "kk32", $msg)
EndIf