Tech: Another Virus Alert (hoax)

Subject: Tech: Another Virus Alert
From: the lemonade lady
Date: 01 Feb 04 - 03:30 PM

Please Be Extremely Careful Especially if using Internet mail such as Yahoo, Hotmail and so on. This information arrived this morning from
Microsoft and Norton.

Please send it to everybody you know who accesses the Internet. You may
receive an apparently harmless email with a Power Point presentation   "Life
is beautiful. pps".   If you receive it DO NOT OPEN THE FILE UNDER ANY
CIRCUMSTANCES, and delete it immediately.

If you open this file, a message will appear on your screen saying: "It is too late now, your life is no longer beautiful", subsequently you will LOSE EVERYTHING IN YOUR PC and the person who sent it to you will gain access to
your name, e-mail and password.

This is a new virus which started to circulate on Saturday afternoon. WE NEED TO DO EVERYTHING POSSIBLE TO STOP THIS VIRUS . AOL has already confirmed the severity, and the antivirus Softs are not capable of destroying it. The virus has been created by a hacker who calls himself
"life owner".

PLEASE MAKE A COPY OF THIS E-MAIL TO ALL YOUR FRIENDS. PASS
IT ON .

Subject: RE: Tech: Another Virus Alert
From: Pene Azul
Date: 01 Feb 04 - 03:40 PM

It's a hoax. The "e-mail to all you friends" warnings are generally (always as far as I have seen) hoaxes.

Jeff

Subject: RE: Tech: Another Virus Alert
From: Walking Eagle
Date: 01 Feb 04 - 03:42 PM

I hate to say this Ms Lemon, but there is something fishy about this.

Subject: RE: Tech: Another Virus Alert (hoax)
From: GUEST
Date: 01 Feb 04 - 03:53 PM

Ms Lemon,

Your intention is no doubt good. Your naivety is remarkable.

Subject: RE: Tech: Another Virus Alert (hoax)
From: the lemonade lady
Date: 01 Feb 04 - 04:07 PM

"Your naivety is remarkable. " ??

Well "Guest" how come you're so clever? Why do you have to be annon? Maybe you started it in the first place. Angry? Yes I'm angry. OK SO I'M A BIT STUPID?

At least Jeff and Walking Eagle can tell me nicely. I read it and decided that it was worth passing on. I had no idea it was a hoax. Thanks guys.

Sal

Subject: RE: Tech: Another Virus Alert (hoax)
From: Teresa
Date: 01 Feb 04 - 04:39 PM

Yes, according to Security Response at Symantec, it's a hoax.
Here are two places to find out about virus hoaxes:
http://securityresponse.symantec.com/avcenter/hoax.html

http://www.nonprofit.net/hoax/
Teresa

Subject: RE: Tech: Another Virus Alert (hoax)
From: Amos
Date: 01 Feb 04 - 06:16 PM

Internet hoaxes, not so much virus warnings, are also analyzed at Snopes.

Subject: RE: Tech: Another Virus Alert (hoax)
From: JohnInKansas
Date: 02 Feb 04 - 04:30 AM

There are a couple of quite virulent worms in circulation, so it would be well for all of us to be particularly "cautious" at this time. And when "one of our own" is concerned, I'm all in favor of knowing it. We can reassure first, and then tease.

There has been enough notice of the "new nasties" that additional descriptions are probably not needed; but one that has not been too widely discussed is a "new" technique for "aliasing" the filename of an attachment.

I'm sure we're all aware of warnings about opening email file attachments we're not sure of, and never open .exe's even (especially) if they're "double extensions;" but with this new scam, the attachment name is phonied up ("aliased" in the email display) so that the file extension(s) aren't what they look like.

If it looks like something you might be interested in, and even if it looks "safe," if you save the attachment to disk before opening it, the "real" file extensions will be displayed, at least for the reported versions of this virus. Be sure you have the "display file extensions" turned on, and look for "double extensions." If it's an exe, dll, java, or other "executable," or something you don't recognize, it probably contains a virus.

Of course, it's better just to delete anything questionable; but if you must look then save before opening, Then look at the saved file before opening it.

Just another cautionary rule to follow.

John

Subject: RE: Tech: Another Virus Alert (hoax)
From: Dave Bryant
Date: 02 Feb 04 - 05:31 AM

We've had several cases of the "Mydoom" virus in the university during the past week.

Subject: RE: Tech: Another Virus Alert (hoax)
From: JohnInKansas
Date: 02 Feb 04 - 08:46 AM

Recent reports have indicated that as much of 18% (that was a few days ago) of email traffic may be infected with MyDoom. Since it "sends itself," and hopefully most people will recognize and delete it, that probably doesn't mean that an incredibly high percentage of machines are infected - yet; but it is one of the most virulent ones seen recently.

A few sites have reported very high hit rates - with as much as 30% of incoming email infected. It's hard to tell how meaningful this kind of figure is though, because the sites that report are generally the better protected ones. If you can't stop it, you can't count it.

Of some concern, the -b variant that appeared recently attempts to block access to AV websites and tech support sites, to prevent you from finding out how to remove it. If it gets loose in your machine, it's too late.

If your AV signatures are current, it should be blocked; but I've printed the instructions just in case. Now if I can just keep track of them until I know I don't need them .... they were here just a little while ago ...

John

Subject: RE: Tech: Another Virus Alert (hoax)
From: nutty
Date: 02 Feb 04 - 02:39 PM

The BBC have issued a warning on the news tonight that the MYDOOM virus is expected to target Microsoft tomorrow ..... apparently it has already caused an appreciable amount of disruption today as it replicates itself so effectively it can block the networks and prevent e-mails from being sent.

Subject: RE: Tech: Another Virus Alert (hoax)
From: GUEST
Date: 02 Feb 04 - 03:03 PM

Most virus software sites give imfo about which viruses are in the wild at the moment, some also have a comprehensive hoax list too. Some hoaxes are so transparant (especially the ones claiming that your PC can give you AIDS).

Subject: RE: Tech: Another Virus Alert (hoax)
From: nutty
Date: 02 Feb 04 - 03:49 PM

i have started a new thread on MYDOOM but I will duplicate the info here..........



                      As of January 26, 2004 1:47 PM (US Pacific Time), TrendLabs has declared a yellow
                      alert to control the spread of WORM_MYDOOM.A (previously known as
                      WORM_MIMAIL.R).

                      This mass-mailing worm selects from a list of email subjects, message bodies, and
                      attachment file names for its email messages. It spoofs the sender name of its
                      messages so that they appear to have been sent by different users instead of the
                      actual users on infected machines.

                      It can also propagate through the Kazaa peer-to-peer file-sharing network.

                      It performs a denial of service (DoS) attack against the software business site
                      www.sco.com. It attacks the site if the system date is February 1, 2004 or later. It
                      ceases attacking the site and running most of its routines on February 12, 2004.

                      It runs a backdoor component, which it drops as the file SHIMGAPI.DLL. The
                      backdoor component opens port 3127 to 3198 to allow remote users to access and
                      manipulate infected systems. Note that it allows remote access even after
                      February 12, 2004.

                      This worm runs on Windows 95, 98, ME, NT, 2000, and XP.

                      Please refer to the Technical Details section for more information on this malware.
                      doom doom doom