Worm warning - PLEASE READ

November 30, 2001

Anyone that has received a private email from maryfischer@...

Please run a virus scan immediately. This person joined our group about 6

weeks ago but never posted. Yesterday she sent me a private email, but the

subject of the email was:

re: re:( ) Kathy B-Day

Although this message LOOKED like it went through the RA list, it did not. It

was a private message. The day after it was sent to me, this person

unsubscribed. I can't say for sure it was intentional sent to me, but it sure

looks like it was because of the way the subject line made it look like it was a

regular RA-Support message, and the fact that this Fisher never posted to

the group or to me personally.

When I clicked on the message, I got a warning that it contained an attachment.

Knowing our list does NOT accept attachments, I was immediately suspicious. The

name of the attachment contained the words : YOU_ARE_FAT. MP3

That's when I KNEW I had a possible infected attachment. I did NOT open the

attachment, I deleted it and ran my virus scanner. I was clean.

Tonight I received a warning that another member thought the W32/Badtrans@MM

worm may have infected her, so I ran my scanner again, and this time I was

infected. This worm is a new variant of the Badtrans worm that was a problem in

the past. Why I was clean last night yet infected tonight, is beyond me but I

have to pass this information on so that everyone will scan their computers.

Here is some information about it:

Since the list doesn't accept attachments, more than likely this worm hasn't

spread through the list, but since a message may APPEAR to have come from the

list, but instead was a personal message, it is better to be safe than sorry and

scan your system. I'd like to know if anyone is infected, so please email me

privately if you've been infected. I'd like to know how many people this

Fisher sent an email to.

a

Recommended Posts