Re: VIRUS ALERT

[mrbadger]

You are one hundred and fifty percent right Terry and as I may have
mentioned once or twice before, some of these guys really gotta get a
life!

TATERRY@aol.com wrote:

>
> In a message dated 00-05-25 11:41:31 EDT, CFritz7001@aol.com writes:
>
> Does anyone know if this virus affects Macs? Or is it species-specific to
> IBM PCs?
> Thanks,
> Carl Fritz
> >>
>
> My understanding has always been that a virus cannot arrive in an
> email...only an attachment and usually in a .exe. Some macro virus' are
> embedded in .doc files.
> The two messages mentioned had no attachments and I've see no evidence of
> virus activity on my PC......which has Norton and it is active. There was no
> alarm.............am I wrong ???
>
> Terry

[Ed Dunn]

Terry, et al;
I ran my normal McAfee VirusScan and came up with nothing as well.
Then I downloaded and ran InoculateIT from Computer Associates
www.cai.com
It inspected over 55,000 files on my disk, versus about 3600 by McAfee
VirusScan. It found seven areas infected by the Kak virus, as reported
here. Again, VirusScan found nothing. I would strongly recommend
installing and running InoculateIT...
Ed

> My understanding has always been that a virus cannot arrive in an
> email...only an attachment and usually in a .exe. Some macro virus'

are

> embedded in .doc files.
> The two messages mentioned had no attachments and I've see no

evidence of

> virus activity on my PC......which has Norton and it is active.

There was no

> alarm.............am I wrong ???
>
> Terry
>
>
>

[Bill Harkins]

The two messages mentioned had no attachments and I've see no evidence of
virus activity on my PC......which has Norton and it is active. There was
no
alarm.............am I wrong ???
The messages did not have the usual paper clip icon on the message list, but
there was an S-shaped icon in the message from which you normally open
attachments. This indicates a script file, which could potentially run a
macro with the KakWorm virus. I deleted the message and then deleted the
message from the "deleted message" folder.
Bill

[Peter Pleitner]

-----Original Message-----
From: Lawrence C. Crane [mailto:lccrane@concentric.net]
Sent: Sunday, March 04, 2001 10:48 PM
To: undisclosed-recipients:;
Subject: Virus alert


FW: another virus!!

> A new virus has just been discovered that has been classified by
>>Microsoft
>>(http://www.microsoft.com/) and by McAfee (http://www.mcafee.com/) as
>the
>>most destructive ever! This virus was discovered yesterday afternoon
>by
>>McAfee and no vaccine has yet been developed. This virus simply
>destroys
>>Sector Zero from the hard disk, where vital information for
>>its functioning are stored. This virus acts in the following manner:
>>It sends itself automatically to all contacts on your list with the
>title:
>>"A Virtual Card for You". As soon as the supposed virtual card is
>>opened, the computer freezes so that the user has to reboot. When the
>>ctrl+alt+del keys or the reset button are pressed, the virus destroys
>>Sector Zero, thus permanently destroying the hard disk. Yesterday in
>just
>>a few hours this virus caused panic in New York, according to news
>>broadcast by CNN(http://www.cnn.com/). This alert was received by an
>>employee of Microsoft itself.
>>So don't open any mails with subject "A Virtual Card for You". As soon

>as
>>you get the mail, delete it. Please pass on this mail to all your
>friends.
>>Forward this to everyone in your address book. I would rather receive
>this
>>25 times than not at all. Also: Intel announced that a new and very
>>destructive virus was discovered recently. If you receive an email
>called
>>"An Internet Flower For You", do not open it. Delete it right away!
>>This virus removes all dynamic link libraries(.dll files) from your
>>computer. Your computer will not be able to boot up=20

[Chip Old]

Peter et al:

The "Virtual Card For You" and "An Internet Flower For You" virus warnings
are hoaxes. See the following URLs for details:

http://www.F-Secure.com/hoaxes/vcredit.shtml
http://www.F-Secure.com/hoaxes/inflower.shtml
http://www.F-Secure.com/hoaxes/iflower.shtml

For future reference, it is always a good idea to check out virus warnings
before redistributing them by e-mail. All of the well-know antivirus Web
sites have information on hoaxes, but my favorite is:

http://www.F-Secure.com

--
Chip Old (Francis E. Old) E-Mail: fold@bcpl.net
Manager, BCPL Network Services Voice: 410-887-6180
Manager, BCPL.NET Internet Services FAX: 410-887-2091
320 York Road
Towson, Maryland 21204 U.S.A.

On Mon, 5 Mar 2001, Peter Pleitner wrote to T-ABCs List and
alfa750-101group:

> -----Original Message-----
> From: Lawrence C. Crane [mailto:lccrane@concentric.net]
> Sent: Sunday, March 04, 2001 10:48 PM
> To: undisclosed-recipients:;
> Subject: Virus alert
>
> FW: another virus!!
>
> > A new virus has just been discovered that has been classified by
> >>Microsoft
> >>(http://www.microsoft.com/) and by McAfee (http://www.mcafee.com/) as
> >the
> >>most destructive ever! This virus was discovered yesterday afternoon
> >by
> >>McAfee and no vaccine has yet been developed. This virus simply
> >destroys
> >>Sector Zero from the hard disk, where vital information for
> >>its functioning are stored. This virus acts in the following manner:
> >>It sends itself automatically to all contacts on your list with the
> >title:
> >>"A Virtual Card for You". As soon as the supposed virtual card is
> >>opened, the computer freezes so that the user has to reboot. When the
> >>ctrl+alt+del keys or the reset button are pressed, the virus destroys
> >>Sector Zero, thus permanently destroying the hard disk. Yesterday in
> >just
> >>a few hours this virus caused panic in New York, according to news
> >>broadcast by CNN(http://www.cnn.com/). This alert was received by an
> >>employee of Microsoft itself.
> >>So don't open any mails with subject "A Virtual Card for You". As soon
>
> >as
> >>you get the mail, delete it. Please pass on this mail to all your
> >friends.
> >>Forward this to everyone in your address book. I would rather receive
> >this
> >>25 times than not at all. Also: Intel announced that a new and very
> >>destructive virus was discovered recently. If you receive an email
> >called
> >>"An Internet Flower For You", do not open it. Delete it right away!
> >>This virus removes all dynamic link libraries(.dll files) from your
> >>computer. Your computer will not be able to boot up=20

[MGTDFL@aol.com]

In a message dated 3/5/01 1:44:38 PM Eastern Standard Time,
pleitner@dundee.net writes:

http://www.cnn.com/).

I went to http://www.cnn.com and found no such news release.

Don

[Chip Old]

On Mon, 5 Mar 2001, MGTDFL@aol.com wrote to pleitner@dundee.net,...:

> I went to http://www.cnn.com and found no such news release.

That's because there never was one. See my reply to Peter's message.

--
Chip Old (Francis E. Old) E-Mail: fold@bcpl.net
Manager, BCPL Network Services Voice: 410-887-6180
Manager, BCPL.NET Internet Services FAX: 410-887-2091
320 York Road
Towson, Maryland 21204 U.S.A.

[Gene Gillam]

Just received the following warning over our company's intranet:


We have observed a new email worm in the wild of unknown virulence, just
wanted to get the word out ASAP. We're calling it "DarkMachine" after the
nicknames of the discoverers here at SecureWorks.

The worm arrives as a .exe attachment with varying names. The subject
line also varies, but the body of the message stays the same:

======

heh. I tell ya this is nuts ! You gotta check it out !

======

Subject lines observed so far include:

======
Kev Gives great orgasms to ladeez!! -- Kev
I don't want to write anything but Si is bullying me. -- Jim
Scientists have found traces of the HIV virus in cow's milk...here is the proof -- Will
A new type of Lager / Weed variant...... sorted !
I want to live in a wooden house -- Arwel
======

The names in the subject lines may or may not be related to the name
of the person sending the email.

The .exe attachment names vary, but the list of ones that we have seen so
far is:

=====
Common.exe
Rede.exe
UserConf.exe
Si.exe
=====

Hope this will keep someone from opening an infected file.

Gene Gillam
Saucier, MS

[Chip Old]

This is the W32/Ucon@MM worm. For details see:

http://vil.mcafee.com/dispVirus.asp?virus_k=99225&

It's not listed on the F-Secure and Symantec sites yet.

On Wed, 17 Oct 2001, Gene Gillam wrote:

> Just received the following warning over our company's intranet:
>
>
> We have observed a new email worm in the wild of unknown virulence, just
> wanted to get the word out ASAP. We're calling it "DarkMachine" after the
> nicknames of the discoverers here at SecureWorks.
>
> The worm arrives as a .exe attachment with varying names. The subject
> line also varies, but the body of the message stays the same:
>
> ======
>
> heh. I tell ya this is nuts ! You gotta check it out !
>
> ======
>
> Subject lines observed so far include:
>
> ======
> Kev Gives great orgasms to ladeez!! -- Kev
> I don't want to write anything but Si is bullying me. -- Jim
> Scientists have found traces of the HIV virus in cow's milk...here is the proof -- Will
> A new type of Lager / Weed variant...... sorted !
> I want to live in a wooden house -- Arwel
> ======
>
> The names in the subject lines may or may not be related to the name
> of the person sending the email.
>
> The .exe attachment names vary, but the list of ones that we have seen so
> far is:
>
> =====
> Common.exe
> Rede.exe
> UserConf.exe
> Si.exe
> =====
>
> Hope this will keep someone from opening an infected file.
>
> Gene Gillam
> Saucier, MS
>
>
>
>
>
>
>
>
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>
>

--
Chip Old (Francis E. Old) E-Mail: fold@bcpl.net
Manager, BCPL Network Services Phone: 410-887-6180
Manager, BCPL.NET Internet Services FAX: 410-887-2091
Baltimore County Public Library
320 York Road
Towson, MD 21204 USA

[R.F.Butson]

----- Original Message -----
From: Christine
To: Undisclosed-Recipient:@mail01.onetel.net.uk;
Sent: Saturday, June 01, 2002 12:19 AM
Subject: Fw: Virus Alert




Subject: Re: Virus Alert


please take notice of this



>From: laura bird
>To: jane wheeler , Paul Wheeler , Leigh , Melanie , Lee Prendigast , Jamie , charlotte , Donna , Lasalle Fields , Alex Fyffe , Emma-louise Bird , John Bird , sahra bird
>Subject: Virus Alert
>Date: Thu, 30 May 2002 21:25:43 +0100 (BST)
>
> > > >Subject: PLEASE READ > > >Dear all > > >Please be aware of this: > > >This information arrived this morning, from Microsoft and Norton. Please > > >send it to everybody you know who accesses the Internet. You may receive > > >an email with a PowerPoint presentation called "Life is beautiful.pps." > > >If you receive it DO NOT OPEN THE FILE UNDER ANY CIRCUMSTANCES, and >delete > > >it immediately. If you open this file, a message will appear on your > > screen > > >saying: "It is too late now, your life is no longer beautiful", > > >subsequently you will LOSE EVERYTHING IN YOUR PC and the person who sent > > it > > >to you will gain access to your name, email and password. This is a new > > >virus which started to circulate on Saturday 11 May, 2002. > > >WE NEED TO DO EVERYTHING POSSIBLE TO STOP THIS VIRUS. AOL has already > > >confirmed its dangerousness, and the antivirus Softs are not capable of > > >destroying it. The virus has been created by a hacker who calls himself > > >"life owner", and who aims to destroying PCs and who also fights >Microsoft > > >in court! That's why it comes disguised > > >with extension pps. He fights in court for the Windows-XP patent.
>
> This one could be genuine...Bob
>


[Non-text portions of this message have been removed]