Heads Up

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

:-\)Liz - 01 Sep 2004 00:12 GMT

We just had a nasty attack of a new virus at work(It was caught and killed
before damage could be done) ....I thought I'd better let ya'll know as you
might open it.. thinking it has photos maybe coming from cat folks...

A new virus is named: Download.Ject.C
If you receive attachments named: Foto.zip Fotos.zip
DO NOT open the attachments. Delete the email.

This is a destructive virus. DO NOT open the attachments, just delete
the email !!
Take Care...Huggs and Pets to the Kitties... :-) Liz

Reply to this Message

EvelynVogtGamble(Divamanque) - 01 Sep 2004 03:14 GMT

:-)Liz wrote:

> We just had a nasty attack of a new virus at work(It was caught and killed
> before damage could be done) ....I thought I'd better let ya'll know as you
[quoted text clipped - 7 lines]
> the email !!
> Take Care...Huggs and Pets to the Kitties... :-) Liz

You make me very glad I have Earthlink's virus protection in place!
They remove known viruses and quarantine those they can't remove (with a
message to the intended recipient), so if the origin is a genuine person
(one you know) you can warn them they're infected, without running the
danger of catching it yourself.

Reply to this Message

Ted Davis - 01 Sep 2004 15:24 GMT

>:-)Liz wrote:
>
[quoted text clipped - 15 lines]
>(one you know) you can warn them they're infected, without running the
>danger of catching it yourself.

Please don't - hardly any virus laden messages are from a machine
belonging to the person in the "From:" header: almost all current
viruses take both the To and From from addresses found on the infected
machine and it's almost never one belonging to the owner of the
infected machine. A person's address in the From header is almost a
guarrantee that the message did *not* come from that person's
computer.

There is some confusion about what trojan it is: the names of the
files involved don't match the ones used by what Symantec calls
Download.Ject.C, but do match the ones used by W32/Bagle.dll.dr,
Bagle.AN, I-Worm.Bagle.an, and W32/Bagle.AN (aliases for the same
thing). The HTML file in the foto.zip attachment also contains the
JS/IllWill/JS/illWill trojan and the foto1.exe file contains the
actual W32/Bagle.AN trojan.

T.E.D. (tdavis@gearbox.maem.umr.edu)
SPAM filter: Messages to this address *must* contain "T.E.D."
somewhere in the body or they will be automatically rejected.

Reply to this Message

EvelynVogtGamble(Divamanque) - 02 Sep 2004 04:04 GMT

> Please don't - hardly any virus laden messages are from a machine
> belonging to the person in the "From:" header: almost all current
[quoted text clipped - 3 lines]
> guarrantee that the message did *not* come from that person's
> computer.

Well, since I've yet to recognize any of the "senders", that's a moot point!

Reply to this Message

tywysoges - 01 Sep 2004 15:38 GMT

> You make me very glad I have Earthlink's virus protection in place!
> They remove known viruses and quarantine those they can't remove (with a
> message to the intended recipient), so if the origin is a genuine person
> (one you know) you can warn them they're infected, without running the
> danger of catching it yourself.

"At this time neither Symantec AntiVirus nor the PureMessage ant-virus
filters on the CIT mail servers are able to detect or block it."

If this is true at my university, then I'm willing to wager that Earthlink
has the same inability to catch this virus.

Currently, the only thing doable here is to temporarily block delivery of
any email attachments named "foto*.zip".

As always, take precautions. Never rely entirely on either your AV
program or your ISP's virus protection.

Adri,
running the best precaution.. Linux ;)

Reply to this Message

EvelynVogtGamble(Divamanque) - 02 Sep 2004 04:06 GMT

> "At this time neither Symantec AntiVirus nor the PureMessage ant-virus
> filters on the CIT mail servers are able to detect or block it."
>
> If this is true at my university, then I'm willing to wager that Earthlink
> has the same inability to catch this virus.

No, they probably CAN'T "catch" it - but they know there's something
there, so they quarantine it, instead.

Reply to this Message

tywysoges - 06 Sep 2004 05:02 GMT

> No, they probably CAN'T "catch" it - but they know there's something
> there, so they quarantine it, instead.

I'm going to force myself to pretend that you didn't just say that.

It's absolutely wonderful when people like you completely ignore what was
said to them, and then pretend that a) they know what's going on and b)
that what was said to them was something completely different and
therefore wrong. Goodluck with not catching a virus.

Reply to this Message

EvelynVogtGamble(Divamanque) - 07 Sep 2004 04:22 GMT

>>No, they probably CAN'T "catch" it - but they know there's something
>>there, so they quarantine it, instead.
[quoted text clipped - 5 lines]
> that what was said to them was something completely different and
> therefore wrong. Goodluck with not catching a virus.

Are you at all FAMILIAR with Earthlink's anti-spam, anti-virus program,
or are you just making holier-than-thou noises?

Reply to this Message

Adrian - 02 Sep 2004 15:31 GMT

:-)Liz wrote:
> We just had a nasty attack of a new virus at work(It was caught and
[quoted text clipped - 9 lines]
> delete the email !!
> Take Care...Huggs and Pets to the Kitties... :-) Liz

I would never open an attachment that I wasn't expecting.

Signature

Adrian (Owned by Snoopy & Bagheera)
A house is not a home, without a cat.

Reply to this Message