Very important Virus Alert

[Guest guest]

In a message dated 11/27/01 1:36:54 AM Mid-Atlantic Standard Time,

writes:

> I received a blank e-mail from the following person ( Moretto). The

> in-list claimed an attachment, but there was no attachment. I replied but

> it

> was bounced back. The name sounds familiar... Any ideas?

>

>

Yes Sue, I think you are the proud owner of a viurs! I got the same thing

this morning from someone on Experimental list and was silly enough to open

it despite not seeing any email text (big warning right there) and have spent

all day reformatting my hard drive and reinstalling everything. The same

virus is affecting another group I am on and I will include. Notice

there is underscore at beginning of name like the following: " _ "

and also notice there are two separate file extensions. Here are the emails

I am copying and pasting to this email. Good luck and everyone on here be on

guard. DO NOT EVER open an attachement unless it is something reasonable

from a friend like a Word/Excel document. I would suggest getting antivirus

software now to get it off your computer. There is free download from here: <A

HREF= " https://www2.my-etrust.com/commerce/register.cfm? " >

Internet security and firewall safety by Computer Associates</A>

Ok, here is the email I am pasting:

> In t cast, it was a file with the extension .SCR which generally

> stands for a screen saver.

>

> As a general rule, we should know that none of the members will post

> attachments that are executables or screen savers. Most attachments in the

> egroups have been either Excel files or Gifs. So if we get an email with

> any other attachment (EG .bat, .exe, .com .... or any other file name

> extension that YOU have not seen previously ) be aware.

>

> Please note that Excel feels can have viruses as embedded macros.

>

> Also note, Have a look at the full name of the attachment before opening,

> because, I have seen virus attachment that look like a normal text file but

> in disguise. (eg FILENAME.TXT.VBS) Note how the file name has got two dots.

> The last three letters are the extension of the file. In this case it is a

> Visual basic script which can infect the computer with a virus.

>

>

Thanks Shiran, as this confirms exactly what I experienced today. This

morning I was one of the unfortunate bastards who did download the .scr file

and it did its damage and I am now reformatted with everything reinstalled

but don't want to go through that again. Yes, you are right about people in

the group sending word or excel files and the viruses having two extensions

and not just one BUT another thing we need to look out for is that the email

body does not have any text so if you see an attachment other than word/excel

AND/OR it has no text you know what to do. What is weird is I got this .scr

virus and it is infecting me from another group but not this one where

it apparently was derived. Or maybe it is infecing many and we

just don't know it yet? One last thing, where can I get a good quality

antiviurs program just like ZoneAlarm for free. I am concerned I am still

infected as even after me reinstalling everything I just got my 3rd email

from a group but this time I deleted it. One other thing anyone in

here can do is temporarily take out the battery in the computer as the virus

can still be hiding in the BIOS. The other thing I just did was not only

download Zonealarm Pro which has over 37 extensions associated with virus in

which it will alert you (only Pro has this feature) but also go into my ISP

(aol for me) and change my password and then select manual password rather

than auto password so I have to type it in next time. I am being a lot more

paranoid from now on.

[Guest guest]

hi all -

I've gotten a number of these today - check out

http://www.mcafee.com/anti-virus/viruses/badtrans/default.asp?cid=2607

for a detailed explanation of how to get it off your computer!

Judith

[Guest guest]

I also got one from a Janet Coffey on ATSG list, and I know a lot of the

same people are on both lists. My anti-virus software caught it - it was the

W32.Badtrans virus. Fortunately it they were caught and I deleted both as is

my policy.

Donna in NC

Very important Virus Alert

> In a message dated 11/27/01 1:36:54 AM Mid-Atlantic Standard Time,

> writes:

>

>

> > I received a blank e-mail from the following person ( Moretto). The

> > in-list claimed an attachment, but there was no attachment. I replied

but

> > it

> > was bounced back. The name sounds familiar... Any ideas?

> >

> >

>

> Yes Sue, I think you are the proud owner of a viurs! I got the same thing

> this morning from someone on Experimental list and was silly enough to

open

> it despite not seeing any email text (big warning right there) and have

spent

> all day reformatting my hard drive and reinstalling everything. The same

> virus is affecting another group I am on and I will include. Notice

> there is underscore at beginning of name like the following: " _ "

> and also notice there are two separate file extensions. Here are the

emails

> I am copying and pasting to this email. Good luck and everyone on here be

on

> guard. DO NOT EVER open an attachement unless it is something reasonable

> from a friend like a Word/Excel document. I would suggest getting

antivirus

> software now to get it off your computer. There is free download from

here: <A HREF= " https://www2.my-etrust.com/commerce/register.cfm? " >

> Internet security and firewall safety by Computer Associates</A>

> Ok, here is the email I am pasting:

>

> > In t cast, it was a file with the extension .SCR which generally

> > stands for a screen saver.

> >

> > As a general rule, we should know that none of the members will post

> > attachments that are executables or screen savers. Most attachments in

the

> > egroups have been either Excel files or Gifs. So if we get an email with

> > any other attachment (EG .bat, .exe, .com .... or any other file name

> > extension that YOU have not seen previously ) be aware.

> >

> > Please note that Excel feels can have viruses as embedded macros.

> >

> > Also note, Have a look at the full name of the attachment before

opening,

> > because, I have seen virus attachment that look like a normal text file

but

> > in disguise. (eg FILENAME.TXT.VBS) Note how the file name has got two

dots.

> > The last three letters are the extension of the file. In this case it is

a

> > Visual basic script which can infect the computer with a virus.

> >

> >

>

> Thanks Shiran, as this confirms exactly what I experienced today. This

> morning I was one of the unfortunate bastards who did download the .scr

file

> and it did its damage and I am now reformatted with everything reinstalled

> but don't want to go through that again. Yes, you are right about people

in

> the group sending word or excel files and the viruses having two

extensions

> and not just one BUT another thing we need to look out for is that the

email

> body does not have any text so if you see an attachment other than

word/excel

> AND/OR it has no text you know what to do. What is weird is I got this

..scr

> virus and it is infecting me from another group but not this one

where

> it apparently was derived. Or maybe it is infecing many and

we

> just don't know it yet? One last thing, where can I get a good quality

> antiviurs program just like ZoneAlarm for free. I am concerned I am still

> infected as even after me reinstalling everything I just got my 3rd email

> from a group but this time I deleted it. One other thing anyone in

> here can do is temporarily take out the battery in the computer as the

virus

> can still be hiding in the BIOS. The other thing I just did was not only

> download Zonealarm Pro which has over 37 extensions associated with virus

in

> which it will alert you (only Pro has this feature) but also go into my

ISP

> (aol for me) and change my password and then select manual password rather

> than auto password so I have to type it in next time. I am being a lot

more

> paranoid from now on.

>

>

>

[Guest guest]

I got the virus from Moretto and J. Gilbert on the list. I tried to open it

both times (stupid). Does anyone know if it is adequate to just erase my

hard drive and re-load my software? Steve B.

>From: " Donna Pruitt " <donnap@...>

>Reply-

>< >

>Subject: Re: Very important Virus Alert

>Date: Tue, 27 Nov 2001 20:08:35 -0500

>

>I also got one from a Janet Coffey on ATSG list, and I know a lot of the

>same people are on both lists. My anti-virus software caught it - it was

>the

>W32.Badtrans virus. Fortunately it they were caught and I deleted both as

>is

>my policy.

>Donna in NC

>

> Very important Virus Alert

>

>

> > In a message dated 11/27/01 1:36:54 AM Mid-Atlantic Standard Time,

> > writes:

> >

> >

> > > I received a blank e-mail from the following person ( Moretto).

>The

> > > in-list claimed an attachment, but there was no attachment. I replied

>but

> > > it

> > > was bounced back. The name sounds familiar... Any ideas?

> > >

> > >

> >

> > Yes Sue, I think you are the proud owner of a viurs! I got the same

>thing

> > this morning from someone on Experimental list and was silly enough to

>open

> > it despite not seeing any email text (big warning right there) and have

>spent

> > all day reformatting my hard drive and reinstalling everything. The

>same

> > virus is affecting another group I am on and I will include.

>Notice

> > there is underscore at beginning of name like the following: " _ "

> > and also notice there are two separate file extensions. Here are the

>emails

> > I am copying and pasting to this email. Good luck and everyone on here

>be

>on

> > guard. DO NOT EVER open an attachement unless it is something

>reasonable

> > from a friend like a Word/Excel document. I would suggest getting

>antivirus

> > software now to get it off your computer. There is free download from

>here: <A HREF= " https://www2.my-etrust.com/commerce/register.cfm? " >

> > Internet security and firewall safety by Computer Associates</A>

> > Ok, here is the email I am pasting:

> >

> > > In t cast, it was a file with the extension .SCR which generally

> > > stands for a screen saver.

> > >

> > > As a general rule, we should know that none of the members will post

> > > attachments that are executables or screen savers. Most attachments

>in

>the

> > > egroups have been either Excel files or Gifs. So if we get an email

>with

> > > any other attachment (EG .bat, .exe, .com .... or any other file

>name

> > > extension that YOU have not seen previously ) be aware.

> > >

> > > Please note that Excel feels can have viruses as embedded macros.

> > >

> > > Also note, Have a look at the full name of the attachment before

>opening,

> > > because, I have seen virus attachment that look like a normal text

>file

>but

> > > in disguise. (eg FILENAME.TXT.VBS) Note how the file name has got two

>dots.

> > > The last three letters are the extension of the file. In this case it

>is

>a

> > > Visual basic script which can infect the computer with a virus.

> > >

> > >

> >

> > Thanks Shiran, as this confirms exactly what I experienced today. This

> > morning I was one of the unfortunate bastards who did download the .scr

>file

> > and it did its damage and I am now reformatted with everything

>reinstalled

> > but don't want to go through that again. Yes, you are right about

>people

>in

> > the group sending word or excel files and the viruses having two

>extensions

> > and not just one BUT another thing we need to look out for is that the

>email

> > body does not have any text so if you see an attachment other than

>word/excel

> > AND/OR it has no text you know what to do. What is weird is I got this

>.scr

> > virus and it is infecting me from another group but not this one

>where

> > it apparently was derived. Or maybe it is infecing many

>and

>we

> > just don't know it yet? One last thing, where can I get a good quality

> > antiviurs program just like ZoneAlarm for free. I am concerned I am

>still

> > infected as even after me reinstalling everything I just got my 3rd

>email

> > from a group but this time I deleted it. One other thing anyone

>in

> > here can do is temporarily take out the battery in the computer as the

>virus

> > can still be hiding in the BIOS. The other thing I just did was not

>only

> > download Zonealarm Pro which has over 37 extensions associated with

>virus

>in

> > which it will alert you (only Pro has this feature) but also go into my

>ISP

> > (aol for me) and change my password and then select manual password

>rather

> > than auto password so I have to type it in next time. I am being a lot

>more

> > paranoid from now on.

> >

> >

> >

[Guest guest]

Moretto here, sorry for the grief I've caused with respect to this virus,

but I too was infected as it was sent from an individual I was previously

corresponding in Eupore.

There were a couple of posts yesterday by NG on what steps are necessary to be

taken to remedy the problem.

Sorry about any inconvenience I have caused.

Regards. J.M.

Very important Virus Alert

>

>

> > In a message dated 11/27/01 1:36:54 AM Mid-Atlantic Standard Time,

> > writes:

> >

> >

> > > I received a blank e-mail from the following person ( Moretto).

>The

> > > in-list claimed an attachment, but there was no attachment. I replied

>but

> > > it

> > > was bounced back. The name sounds familiar... Any ideas?

> > >

> > >

> >

> > Yes Sue, I think you are the proud owner of a viurs! I got the same

>thing

> > this morning from someone on Experimental list and was silly enough to

>open

> > it despite not seeing any email text (big warning right there) and have

>spent

> > all day reformatting my hard drive and reinstalling everything. The

>same

> > virus is affecting another group I am on and I will include.

>Notice

> > there is underscore at beginning of name like the following: " _ "

> > and also notice there are two separate file extensions. Here are the

>emails

> > I am copying and pasting to this email. Good luck and everyone on here

>be

>on

> > guard. DO NOT EVER open an attachement unless it is something

>reasonable

> > from a friend like a Word/Excel document. I would suggest getting

>antivirus

> > software now to get it off your computer. There is free download from

>here: <A HREF= " https://www2.my-etrust.com/commerce/register.cfm? " >

> > Internet security and firewall safety by Computer Associates</A>

> > Ok, here is the email I am pasting:

> >

> > > In t cast, it was a file with the extension .SCR which generally

> > > stands for a screen saver.

> > >

> > > As a general rule, we should know that none of the members will post

> > > attachments that are executables or screen savers. Most attachments

>in

>the

> > > egroups have been either Excel files or Gifs. So if we get an email

>with

> > > any other attachment (EG .bat, .exe, .com .... or any other file

>name

> > > extension that YOU have not seen previously ) be aware.

> > >

> > > Please note that Excel feels can have viruses as embedded macros.

> > >

> > > Also note, Have a look at the full name of the attachment before

>opening,

> > > because, I have seen virus attachment that look like a normal text

>file

>but

> > > in disguise. (eg FILENAME.TXT.VBS) Note how the file name has got two

>dots.

> > > The last three letters are the extension of the file. In this case it

>is

>a

> > > Visual basic script which can infect the computer with a virus.

> > >

> > >

> >

> > Thanks Shiran, as this confirms exactly what I experienced today. This

> > morning I was one of the unfortunate bastards who did download the .scr

>file

> > and it did its damage and I am now reformatted with everything

>reinstalled

> > but don't want to go through that again. Yes, you are right about

>people

>in

> > the group sending word or excel files and the viruses having two

>extensions

> > and not just one BUT another thing we need to look out for is that the

>email

> > body does not have any text so if you see an attachment other than

>word/excel

> > AND/OR it has no text you know what to do. What is weird is I got this

>.scr

> > virus and it is infecting me from another group but not this one

>where

> > it apparently was derived. Or maybe it is infecing many

>and

>we

> > just don't know it yet? One last thing, where can I get a good quality

> > antiviurs program just like ZoneAlarm for free. I am concerned I am

>still

> > infected as even after me reinstalling everything I just got my 3rd

>email

> > from a group but this time I deleted it. One other thing anyone

>in

> > here can do is temporarily take out the battery in the computer as the

>virus

> > can still be hiding in the BIOS. The other thing I just did was not

>only

> > download Zonealarm Pro which has over 37 extensions associated with

>virus

>in

> > which it will alert you (only Pro has this feature) but also go into my

>ISP

> > (aol for me) and change my password and then select manual password

>rather

> > than auto password so I have to type it in next time. I am being a lot

>more

> > paranoid from now on.

> >

> >

> >

[Guest guest]

No problem ,It could have happened to anyone.It spreads so easily and is

very difficult to control!

Nil

Very important Virus Alert

> >

> >

> > > In a message dated 11/27/01 1:36:54 AM Mid-Atlantic Standard Time,

> > > writes:

> > >

> > >

> > > > I received a blank e-mail from the following person (

Moretto).

> >The

> > > > in-list claimed an attachment, but there was no attachment. I

replied

> >but

> > > > it

> > > > was bounced back. The name sounds familiar... Any ideas?

> > > >

> > > >

> > >

> > > Yes Sue, I think you are the proud owner of a viurs! I got the same

> >thing

> > > this morning from someone on Experimental list and was silly enough

to

> >open

> > > it despite not seeing any email text (big warning right there) and

have

> >spent

> > > all day reformatting my hard drive and reinstalling everything. The

> >same

> > > virus is affecting another group I am on and I will include.

> >Notice

> > > there is underscore at beginning of name like the following: " _ "

> > > and also notice there are two separate file extensions. Here are

the

> >emails

> > > I am copying and pasting to this email. Good luck and everyone on

here

> >be

> >on

> > > guard. DO NOT EVER open an attachement unless it is something

> >reasonable

> > > from a friend like a Word/Excel document. I would suggest getting

> >antivirus

> > > software now to get it off your computer. There is free download

from

> >here: <A HREF= " https://www2.my-etrust.com/commerce/register.cfm? " >

> > > Internet security and firewall safety by Computer Associates</A>

> > > Ok, here is the email I am pasting:

> > >

> > > > In t cast, it was a file with the extension .SCR which

generally

> > > > stands for a screen saver.

> > > >

> > > > As a general rule, we should know that none of the members will

post

> > > > attachments that are executables or screen savers. Most

attachments

> >in

> >the

> > > > egroups have been either Excel files or Gifs. So if we get an

email

> >with

> > > > any other attachment (EG .bat, .exe, .com .... or any other file

> >name

> > > > extension that YOU have not seen previously ) be aware.

> > > >

> > > > Please note that Excel feels can have viruses as embedded macros.

> > > >

> > > > Also note, Have a look at the full name of the attachment before

> >opening,

> > > > because, I have seen virus attachment that look like a normal text

> >file

> >but

> > > > in disguise. (eg FILENAME.TXT.VBS) Note how the file name has got

two

> >dots.

> > > > The last three letters are the extension of the file. In this case

it

> >is

> >a

> > > > Visual basic script which can infect the computer with a virus.

> > > >

> > > >

> > >

> > > Thanks Shiran, as this confirms exactly what I experienced today.

This

> > > morning I was one of the unfortunate bastards who did download the

..scr

> >file

> > > and it did its damage and I am now reformatted with everything

> >reinstalled

> > > but don't want to go through that again. Yes, you are right about

> >people

> >in

> > > the group sending word or excel files and the viruses having two

> >extensions

> > > and not just one BUT another thing we need to look out for is that

the

> >email

> > > body does not have any text so if you see an attachment other than

> >word/excel

> > > AND/OR it has no text you know what to do. What is weird is I got

this

> >.scr

> > > virus and it is infecting me from another group but not this

one

> >where

> > > it apparently was derived. Or maybe it is infecing many

groups

> >and

> >we

> > > just don't know it yet? One last thing, where can I get a good

quality

> > > antiviurs program just like ZoneAlarm for free. I am concerned I am

> >still

> > > infected as even after me reinstalling everything I just got my 3rd

> >email

> > > from a group but this time I deleted it. One other thing

anyone

> >in

> > > here can do is temporarily take out the battery in the computer as

the

> >virus

> > > can still be hiding in the BIOS. The other thing I just did was not

> >only

> > > download Zonealarm Pro which has over 37 extensions associated with

> >virus

> >in

> > > which it will alert you (only Pro has this feature) but also go into

my

> >ISP

> > > (aol for me) and change my password and then select manual password

> >rather

> > > than auto password so I have to type it in next time. I am being a

lot

> >more

> > > paranoid from now on.

> > >

> > >

> > >