wss4 DO A VIRUS UPDATE, SCAN...etc..

[Mouse7088]

Hey there..I can't really email you since I am now having your emails come back to me with a virus attachment..no harm done, ISP virus email program keeps stopping them..The first one had no subject, but the attachment "audio/x-wav; name="SETUP.DOC.scr".
The second one had the subject "Re: DOD Christmas Card List" (obviously one I had sent you earlier at some point) and the attachment "audio/x-wav; name="ME_NUDE.MP3.scr".
Good luck!! Yipes!

[Mouse7088]

Lisa....you too babe..geesh..you all trying to get rid of me or what? LOL!
Lisa..your's I found VERY VERY VERY strange...


Date: Mon, 26 Nov 2001 13:49:11 -0500
From: "Lisa ********" <*****@flash.net


Attachments:
audio/x-wav; name="Humor.MP3.scr"

First the addy is shows for you and also the fact you NEVER email me at the ICQ email....hmmmmm.

[sushiosushi]

looks like same type of virus that lovemydogs got over the weekend.

NOTE: THIS IS A PASSWORD STEALING PROGRAM BY LOGGING THE KEYS THAT ARE TYPED ON YOUR KEYBOARD!!!


[Only registered and activated users can see links. Either login above or Register Now]


Name: W32/Badtrans-B
Type: Win32 worm
Date: 24 November 2001

A virus identity file (IDE) which provides protection is
available now from our website and will be incorporated
into the January 2002 (3.53) release of Sophos Anti-Virus.

At the time of writing Sophos has received just one report of
this worm from the wild.

Description:

W32/Badtrans-B is a worm which uses MAPI to spread. The worm
arrives in an email message with no message text. The attachment
filename is randomly generated from three parts. The first part
is taken from the list:

FUN
HUMOR
DOCS
S3MSONG
Sorry_about_yesterday
ME_NUDE
CARD
SETUP
SEARCHURL
YOU_ARE_FAT!
HAMSTER NEWS_DOC
New_Napster_Site
README
IMAGES
PICS

The second from the list:

.DOC.
.MP3.
.ZIP.

and the last from:

pif
scr

If the attached file is run, it copies itself into the Windows
system directory with the filename KERNEL32.EXE and changes the
registry key
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce so that
the worm runs the next time Windows is started. The worm also
drops a file named kdll.dll, which is the password stealing
Trojan Troj/PWS-AV.

[KAZMAN]

FROM : [Only registered and activated users can see links. Either login above or Register Now]

========================================
new variant of a mass-mailing Internet worm has been spreading rapidly over the weekend and is reported to be reaching the epidemic levels of SirCam, according to antivirus companies.

The "B" variant of the W32/BadTrans@MM worm has been attacking home and corporate PCs running Microsoft Outlook. It has initially been categorized as a medium-level risk but is expected to reach high-risk levels by the end of Monday.
"All affected domains that we have detected have been" Internet service providers for home users, said Mark Sunner, chief technology officer at British antivirus company MessageLabs. "It looks like the worm is gestating in the fertile ground of the home-user base, but corporate users will be coming into work (Monday) and setting it off on business networks."

By Monday midmorning British time, MessageLabs was detecting 100 instances of the worm passing through its e-mail screening servers each minute. On an average day, 10,000 viruses will be intercepted by MessageLabs at an Internet level, but Sunner expects more than 30,000 reports today, with 10,000 attributable to W32/BadTrans-B.

The "B" variant, which is though to have originated from Britain, combines a mass-mailing mechanism with a Remote Access Trojan (RAT). RATs allow remote control over a machine, with the user having no idea that it has been infected. In this case, the RAT is dropped into the Windows directory, which attempts to e-mail the victim's IP address to the virus' author and allows the author to access the PC and steal passwords and other sensitive information. The Trojan horse also contains a program that records all keystrokes typed on the infected computer, potentially capturing other vital information such as credit card and bank account numbers.

The worm arrives as an attachment to an e-mail message that is 13.3 kilobytes in length. It spreads through Microsoft Outlook by replying to any unread messages in an infected user's inbox.

"Because it isn't using a security exploit but rather Microsoft Outlook to spread, people are just as vulnerable to infection as they were with Melissa and Love Letter, if they have no protection in place," said David Emm, product and marketing manager for antivirus software maker McAfee.

The original BadTrans worm was detected on April 11. Computer users running Outlook can protect themselves against the new variant by updating their antivirus software.

[pandybat]

Bad virus going around...it's spreading like wildfire. I also got this one this morning from Wendy and I emailed her but it did not come back to me.

Here is information on the new virus making the rounds.

[Only registered and activated users can see links. Either login above or Register Now]

It could be entitled one of several things including:
Pics.ZIP.scr
images.pif
README.TXT.pif
New_Napster_Site.DOC.scr
news_doc.scr
hamster.ZIP.scr
YOU_are_FAT!.TXT.pif
searchURL.scr
SETUP.pif
Card.pif
Me_nude.AVI.pif
Sorry_about_yesterday.DOC.pif
s3msong.MP3.pif
docs.scr
Humor.TXT.pif
fun.pif

What it does is look for any emails not yet read yet and attaches itself to those and sends the virus back to those people. If you have your anti-virus system working and updated, you will get an alert calling it: w32 badtrans virus so you can direct your system to quarantine it. If you do not have an anti-virus program on your computer, it is highly recommended that you install one. This particular virus plopped itself down on unopened emails, including those that have been deleted without reading. Before, you had to actually open an attachment in order to get a virus. So, you´re really not safe anymore without an anti-virus program. Norton Antivirus is a good one.

I keep getting this virus from several people on a sweepstakes list I am on. It tries to automatically open Windows Media Player as soon as the email opens. Tricky thing with this one is most times you don't even know its in the email till you open it. If it's an email from someone you know, like Wendy, you have no reservations about opening it. But by then, it's too late. Be reminded, these people you are getting this virus from are not sending them to you on purpose. It is sending emails by itself without them even knowing it. No bad feelings at all Wendy, just hope you can get it fixed soon. Good luck!

[pandybat]

Here is a free scanner that requires no download, no actual usage on your computer so it won't matter about your memory.

[Only registered and activated users can see links. Either login above or Register Now]

If you find out you have this virus in your system, go to [Only registered and activated users can see links. Either login above or Register Now] and find the tools to get rid of it.

[AndersonGal]

Trying my luck at:[Only registered and activated users can see links. Either login above or Register Now]

Keep the ideas coming please.

[LISA1013]

omg !!! i just sent wendy an email and a pm on this .. i got a very strange one from her From: "Wendy Stines" <_wendys@suwanneevalley.net>



To: [Only registered and activated users can see links. Either login above or Register Now]



Subject: Re:



Date: Mon, 26 Nov 2001 09:06:20 -0500 (EST)





--------------------------------------------------------------------------------

Part: 2

Attached File: Me_nude.MP3.scr Download


and other from ???


*Barbara Hudnall

and other from ???

Terry


what the heck is going on ???

[Mouse7088]

Well...2 more just "caught/stopped"..from:

Date: Mon, 26 Nov 2001 11:12:44 -0800
From: "the3geese" <[Only registered and activated users can see links. Either login above or Register Now].net>
To: [Only registered and activated users can see links. Either login above or Register Now]
Subject: Re:


Attachments:
audio/x-wav; name="docs.DOC.pif"

I also got one yesterday.

Here's something I am noticing..in each return email addy there is a_ which is not normally there.

[LISA1013]

just got one from ~ the3geese

[AndersonGal]

That's me.
How would you get one from the email ady I don't use for here?

This is wierd.
Found my infected files but will not let me delete

(the3geese)

[devlina2u]

Oh man! Hate it when these things happen!

[devlina2u]

I got mails from the3geese, someone named Wendy Stines and Lisa (your office email). I was surprised as to why nothing was written and it was an attachment! Thank goodness I deleted them. *whew*

[AndersonGal]

I remember seeing the "YOU-are_FAT!.TXT.pif" email.

I remember because I thought to you!
I just lost 20lbs.
LOL-Thought somebody was just being mean, well I guess they were at that anyways.

I still have a question though.
How are you guys getting emails from my ady when I have always sent you emails from on online account on a different browser? duh.....

[Mouse7088]

Dev..Wendy is wss4.
Man...this is unreal..I wish I could rename this topic to CHECK TO SEE IF YOU HAVE SENT A VIRUS! Maybe more people would check and add names that the rest of us could be on look out for. Then also those that have been infected may be warned earlier and could start the "getting clean" process.