Tech: Despicable Virus Alert

Subject: RE: Tech: Despicable Virus Alert
From: The Fooles Troupe
Date: 18 Oct 04 - 03:31 AM

This was a trawl... an email address harvester.

Subject: RE: Tech: Despicable Virus Alert
From: Cluin
Date: 17 Oct 04 - 11:33 PM

I don't believe it exists. Symantec has never heard of it and the only website Google turned up was a come-on.

Subject: RE: Tech: Despicable Virus Alert
From:
Date: 17 Oct 04 - 10:55 PM

how do I get rid of freeman.vbs-notpad off my computor ???

Subject: RE: Tech: Despicable Virus Alert
From: Stilly River Sage
Date: 04 Aug 03 - 09:13 AM

There's a new warning out, here is the information from Symantec.

It's called W32.Mimail.A@mm and sets itself up to appear to be a message from your system's administrator telling you that your email address is about to expire.

From Symantec:

Uses its own SMTP server to spread by email.
The email has the following characteristics:

From: admin@ (The from address may be spoofed as if to appear it is coming from the current domain)

Subject: your account %s

Message:
Hello there,
I would like to inform you about important information regarding your email address. This email address will be expiring. Please read attachment for details.

Best regards,
Administrator

Attachment: Message.zip


Message.zip contains only one file, Message.htm, which uses a code base exploit to create a copy of the worm named Foo.exe in the Temporary Internet Files folder, and then runs it. The compression method for this file inside the zip file is stored so that there is no compression used at all.

Information about this vulnerability and a Microsoft patch is located at: http://support.microsoft.com/default.aspx?scid=kb;en-us;330994
System administrators are encouraged to apply the Microsoft patch to prevent infection by this worm.

SRS

Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow
Date: 11 May 00 - 01:31 PM

Bradypus - you've done it again.

Subject: RE: Tech: Despicable Virus Alert
From: GUEST,digger
Date: 11 May 00 - 12:08 PM

Ahhh, the old ones are the best:

WARNING! WARNING! WARNING! IF YOU RECEIVE A GIFT IN THE SHAPE OF A LARGE WOODEN HORSE DO NOT DOWNLOAD IT!!!! It is EXTREMELY DESTRUCTIVE and will overwrite your ENTIRE CITY! The "gift" is disguised as a large wooden horse about two stories tall. It tends to show up outside the city gates and appears to be abandoned. DO NOT let it through the gates! It contains hardware that is incompatible with Trojan programming, including a crowd of heavily armed Greek warriors that will destroy your army, sack your town, and kill your women and children. If you have already received such a gift, DO NOT OPEN IT! Take it back out of the city unopened and set fire to it by the beach. FORWARD THIS MESSAGE TO EVERYONE YOU KNOW! Poseidon ****************************** RE: Greeks bearing gifts Laocoon, I hate to break to you, but this is one of the oldest hoaxes there is. I've seen variants on this warning come through on other listservs, one involving some kind of fruit that was supposed to kill the people who ate it and one having to do with something called the "Midas Touch". Here are a few tip-offs that this is a hoax: 1) This "Forward this message to everyone you know" business. If it were really meant as a warning about the Greek army, why tell anyone to post it to the Phoenicians, Sumerians, and Cretans? 2) Use of exclamation points. Always a giveaway. 3) It's signed "from Poseidon". Granted he's had his problems with Odysseus but he's one of their guys, isn't he? Besides, the lack of a real header with a detailed address makes me suspicious. 4) Technically speaking, there is no way for a horse to overwrite your entire city. A horse is just an animal, after all. Next time you get a message like this, just delete it. I appreciate your concern, but once you've been around the block a couple times you'll realize how annoying this kind of stuff is. Bye now, Hector

Subject: RE: Tech: Despicable Virus Alert
From: Escamillo
Date: 11 May 00 - 07:05 AM

Excellent, Bradypus!
A quarter of my left eye is on TV, where a new lethal virus is being announced. I've noticed that the stupid box' alerts are always true. I think lots of imitations of the "I love you" warm are being spread out by now, and an analogy comes to my mind:
If you receive 6 or 7 envelopes in your HOME mail box every day, and if you know that many bombs are circulating, and some of them have sent a neighbour to the hospital, would you open them all, including those from unknown senders, and those from known senders but which envelopes carry attractive labels ?
Sorry for the insistence - I´m a programmer and make a living at this machine -
Un abrazo - Andrés

Subject: RE: Tech: Despicable Virus Alert
From: katlaughing
Date: 10 May 00 - 11:17 PM

Ditto, Bradypus!! When do we get to hear you sing it?

Barry Finn, sorry to hear that, but glad to know why we haven't seen much of you lately. Hope you can get a new one or something soon. Shredder, huh? That'd put you right up there with Richard Craft- the woodchipper of wife!**BG**

Subject: RE: Tech: Despicable Virus Alert
From: Jeri
Date: 10 May 00 - 09:19 PM

Bradypus, that is BRILLIANT!

Subject: RE: Tech: Despicable Virus Alert
From: GUEST,Barry Finn
Date: 10 May 00 - 08:37 PM

I'm so glad I didn't bite this bug, couldn't even if I wanted too. My computer hasn't recovered from the last bite that bit it & it's been eaten up completely & if I ever get my hands on a HACKER it's straight to the shreader. Barry (whose only able to drop in now & again from work)

Subject: RE: Tech: Despicable Virus Alert
From: Bradypus
Date: 10 May 00 - 07:51 PM

There was a letter to the editor in today's Daily Telegraph:

SIR - The episode of the "love bug" virus proves once again the truth of the old saying that the e-mail of the species is more deadly than the mail.

After McGrath's contribution to Song Challenge 26, I couldn't resist ...

Love Bytes

For up to date communication the computer is the king
And to get your message over e-mail seems to be the thing
But one fact is oft neglected, and it makes our systems fail
For the e-mail of the species is more deadly than the mail

For the junk we get by snail mail simply lands upon the mat
And it's dormant and it's lifeless as it lies there rather flat
But the junk we get by e-mail seems to tell a different tale
For the e-mail of the species is more deadly than the mail

First the message says 'I love you', then you find that you're infected
And you wish you'd taken measures for to keep yourself protected
As in life, so with computers, and it makes you quake and quail
For the e-mail of the species is more deadly than the mail

It infects your words and pictures, your jpeg and mp3
And makes you wish you'd never seen extension vbe
Your address book is subverted, all your friends will weep and wail
For the e-mail of the species is more deadly than the mail

We can hardly do without it, though we know the risks it brings
For it's faster and it's slicker, like so many e-type things
But whene'er it's out of kilter it can turn the strongest pale
For the e-mail of the species is more deadly than the mail

Subject: RE: Tech: Despicable Virus Alert
From: Escamillo
Date: 10 May 00 - 04:02 PM

Beware of ZDNet (publishers of PCMagazine). I downloaded a freeware utility from their list of "top of the week" and got a TROJAN from Aureate.com, known spammers, asking me to fill a form for "statistical purposes" and a single button "continue" without alternatives to exit. I wrote to them just to ask if they knew about these practices and got NO reply. Looking at their Privacy Policy fine print, I found that they reserve the right to give away all your personal information to whoever they consider reliable. (!!)
This is NOT a hoax !:))
Un abrazo - Andrés

Subject: RE: Tech: Despicable Virus Alert
From: SINSULL
Date: 10 May 00 - 04:02 PM

I thought Jeri covered that already??? McG, are you posting without reading again? You just made me go back and read it all ALL OVER AGAIN. Of course i was also stupid enough to believe that my boss sent me a love letter.

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 10 May 00 - 03:44 PM

Warning: If you don't recieve an email saying "Danger: Hoax Not Found", DON'T OPEN IT. It will send your dog to Newfoundland and rewire your truck to backfire at noon GMT, erase all your third-grade watercolors and forward your underwear to the Central Intelligence Agency. This is a little known bug which has just been announced by AOL, IBM, Motorola, Microsoft, and the Trilateral Commission. Please forward this to everyone you know so they will be safe if they don't get this terirble e-mail.

A

There ya go, Cletus -- take it home and give it to your Mom. But note that her penicillin won't work on this one.

Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow
Date: 10 May 00 - 03:30 PM

I wonder if there are ever hoax warnings about hoaxes that don't exist? But how can you warn someone about that? I feel an infinite regression creeping up on me. Better warn people about that...

Subject: RE: Tech: Despicable Virus Alert
From: SINSULL
Date: 10 May 00 - 01:23 PM

Last week, someone on Mudcat warned us about "prettyparks". I can't find the thread but still want to say thank you. It showed up in our email today in the guise of a quote request but thanks to the warning and last week's horror show, no one opened it. Can't say the same for all my competitors and suppliers. Again, THANK YOU.

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 10 May 00 - 11:53 AM

ZD Net also offers downloads of cures for LoveBug related attacks on this page.

A

Subject: RE: Tech: Despicable Virus Alert
From: GUEST,CLETUS
Date: 10 May 00 - 11:52 AM

Miz kat, I wuzza thinkin az ta how ya mite git mor notice an all ifn you were nekkid. Then agin whut withall theez puter fellers it mite not do no good 'tall. But thet aint whut I come ta axt. Thizzeer thred sez thet thiz iz a despicable virus an I wuzza wundrin ifn thair wuz sum nice upstandin virus like one ya cud take home ta meet yer Momma?

CLETUS

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 10 May 00 - 11:34 AM

From ZDNet, another blanketyblamk LoveBug variant -- damn Psychos. Orignal link is over here.

New 'ILOVEYOU' worm detected
There's a new worm based on "ILOVEYOU" (Loveletter.A). It's different enough that it has it's own name, "Friendmess.A." This new worm rewrites the Autoexec.bat file so that it deletes the Windows directory and the Windows/System and Windows/Temp subdirectories. While the "Friend Message" worm does not spread through IRC chat rooms, it does use MS Outlook address books. Full Story -- Robert Vamosi, ZDNet Help & How To

See also: ZDNN's Computing section

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 10 May 00 - 01:06 AM

Kat -- I don't know what the bug is but at least part of it is at their end.

Subject: RE: Tech: Despicable Virus Alert
From: Escamillo
Date: 10 May 00 - 12:59 AM

Sorry Kat I still didn´t have the time to download the files (pretty big), will try later.
Regarding hoaxes or false alerts or humanitarian requests, if someone did not see my post in another thread, I´d like to remind you that there is not only a huge loss in productive activity, there is also a more evil intention in hoaxers: in general, a long list of genuine addresses from your book gets included in your messages, as well as those being carried from previous posters, and those that the next generation will carry. These thousands of e-mails reach some PC where the hoaxers planted a TROJAN program, then it will collect them and send copies to their headquarters as soon as you connect to the Web (and of course it will never report to you what it is doing). Those lists are then sold to SPAMMERS like Aureate, Radiate and many, many others. Myself have received many offers for lists, from 80.00 to 200.00 . Please don´t redistribute anything that asks for redistribution, and don´t loose your time in checking if it is a hoax or not. I suspect those sites are not reliable.
Un abrazo - Andrés

Subject: RE: Tech: Despicable Virus Alert
From: katlaughing
Date: 10 May 00 - 12:32 AM

Would one of you please respond to my question about Paul G's MP3 thread and linking? Please go try it and let us all know if it is just my computer or something at MP3?

Sheesh! Whadda I gotta do ta' get noticed around here amongst all them number-crunchers?!!!**BG**

T'anks!

kat

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 10 May 00 - 12:06 AM

Add to your calculations re these hoaxes the manpower factor if it takes an average hoaxee, say, seven minutes to open, read, absorb, react, and forward to his five friends the Email containing the hoax.

The next five people, assuming all are newbie-class, take the total up to 7 +(5x7)=42 minutes. The next wave, 42 + (7x25) = 197, or 3 hours and 17 minutes. Assuming (conservatively) 5 seconds actual relay time the ratio of linear time to wasted time after these three iterations is 21.25: 197. The wasted time, valued at a modest $15/hour for an adult professional amounts to $50 in the first 21 minutes. in the next 21 minutes this wastage multiplies: from 25 people to 125 to 625 to 3125 people. That's 3875 times 7 minutes, or 27125 minutes (452.083 hours) in the second set of three steps, valued at $6781additional. So in about 43 minutes the waste curve in terms of productive human time goes from $1.75 to $6832 cumulative waste.

Draw that curve on a chart and you can see why forwarding a hoax scare without checking it can grow to a hormongous loss to the productive community world-wide. Of course this is an idealized model, but the rate it reflects is about right.

A

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 07:05 PM

Yes but lets go email from here. Either way though, it is a good example of how a simple thing and small numbers turn into mind blowing numbers in very few steps. Which I think is imortant to remember with these virus warning things.

Jon

Subject: RE: Tech: Despicable Virus Alert
From: Jeri
Date: 09 May 00 - 06:57 PM

Wanna see my spreadsheet?

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 06:35 PM

I dnon't know if my maths are right but this logic seems to follow: one square = 1 grain, 2 = 3 grains, 3=7 grains in totlal which in each case works out as (2^Sqares)-1. By that reckoning we are looking at 2 to the power 64 - 1 which I can't calculate exactly using Excel and my C compiler is being stubborn.

We had the same number of digits though. by my reckoning which may well be wrong, we are looking around 18,446,744,073,709,600,000

Jon

Subject: RE: Tech: Despicable Virus Alert
From: Jeri
Date: 09 May 00 - 06:19 PM

Just a guess, but how's 73,786,976,294,838,200,000 sound?

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 05:52 PM

Jeri, here is a puzzle for you. Put one grain of rice on the first square of a chess board, 2 on the next, 4 on the next (keep doubling). How many grains do you need to cover all the squares?

Jon

Subject: RE: Tech: Despicable Virus Alert
From: Jeri
Date: 09 May 00 - 04:52 PM

There's a very good place to check for hoaxes (BEFORE you e-mail all 700 people in your address book) here, at F-Secure Corporation. They also list chain letters. Folks, one rule of thumb is, it's a chain letter/hoax if it says to send it to everyone you know.

I was curious about how many people these things go to. I did the math. If each person who gets it sends it to 5 people, and the mailings only happen once per day, at the end of the 10th day, the message will have been sent a total of 2,441,405 times. I'm guessing in real life, these things have a much shorter turn-around time, and people mail them to more than 5 others. I guess I don't have to wonder why the internet gets so slow at times.

Subject: RE: Tech: Despicable Virus Alert
From: MMario
Date: 09 May 00 - 04:01 PM

So is "Win a Holiday". Also - you can be 99.99% sure it's a hoax if the message asks you to "send it to as many people as possible" or a variation on that.

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 03:53 PM

Wobbler is a known hoax.

Jon

Subject: RE: Tech: Despicable Virus Alert
From: GUEST,Nick Jones
Date: 09 May 00 - 03:50 PM

Subject: FW: VIRUS ALERT Date: Wed, 26 Apr 2000 14:17:12 +0100 Subject: Virus Alert Importance: High I received this message today. Please forward it on. There is a new virus - WOBBLER. It will arrive on e-mail titled "CALIFORNIA". IBM and AOL have announced that it is very powerful, more so than Melissa, there is no remedy. It will eat all your information on the hard drive and also destroys Netscape Navigator and Microsoft Internet Explorer. Do not open anything with this title and please pass this message on to all your contacts and anyone who uses your e-mail facility. Not many people seem to know about this yet, so propagate it as fast as possible. If you receive an e-mail titled "Win A. Holiday", DO NOT open it. It will erase everything on your hard drive. Forward this letter out to as many people as you can. This is a new, very malicious virus and not many people know about it. This information was announced yesterday morning from Microsoft. Mike Johnson

Subject: RE: Tech: Despicable Virus Alert
From: katlaughing
Date: 09 May 00 - 03:21 PM

Hey, would one of you *buffs* go over to the Paul G's new CD - MP3 thread and read what I posted about my computer shutting down when I tried to download files form MP3 and see what you think, PLEASE? I'd like to know if it is just me or something to do with MP3. Thanks, a bunch!

kat

Subject: RE: Tech: Despicable Virus Alert
From: SeanM
Date: 09 May 00 - 03:05 PM

Re: the Y2K glitch...

It DID have some practical effects on the world, but they were covered fairly quickly.

I work for a company that does a fair amount of work with credit card charges, and due to a faulty update, over a period of roughly two weeks anyone who was charged suddenly found themselves being recharged on a daily basis until the company found the bug and stopped it.

As of now, I believe that they've finally fixed the problem and reversed the charges. However, it wasn't just us that got hit... The rough estimate that we heard was something in the neighborhood of 7-800,000 affected consumers.

There were other smaller problems as well, that were cleared before hand. During a test a few months before New Year's at a local Waste Management facility, a computer failed to register a real alarm during the test and dumped a few hundred gallons of raw sewage into a local drainage canal. I've also heard of a few cases of the traffic grid going briefly haywire during very late night tests that they ran in Loa Angeles.

As Amos more or less said, I feel we got off lucky.

M

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 09 May 00 - 02:20 PM

Add to the list the German variant "Sehr geehrte Damen und Herren!"

McGrath, the Y2K issues was no joke, and I am still very surprised how few major catastrophes occurred; I am especially surprised that more embedded and forgotten controller ships didn't turn up with date-sensitive architecture. But I have heard enough actual reports of whole factories shutting down mid-job during remediation testing, and complex systems wrapping themselves around phone poles because the mismanaged date field was souring data transfers or forcing logical loops in whacky ways ... that I am very grateful as much remediation occurred as did. Had it not occurred, I am confident we would have inherited a lot more chaos.

Also, with all due respect, computer gurus right now are not at any risk of being out of work. Over here, anyway, the unemployment rate is the lowest it has been in years and anyone competent in a technical field has a premium on his head as a desireable employee because there are so many fronts on which new technologies are being deployed.

Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow
Date: 09 May 00 - 01:46 PM

Well, they should "have emerged with great credibility" - but the problem was they did such a good job fixing the Millennium Bug that lots of people assumed it had never been there in the first place.

Big mistake. If you're doing something difficult it can help to make a few mistakes to show people it's difficult - like streetwise jugglers do. I like to remember this when I screw up a song or a tune...

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 01:42 PM

Yes WillieO and McGrath, I can see the psychological angle but to come back to GeorgeH's comments, I still can't help but wonder what people were doing opening such attachments within working environments such as hospitals. Surely these risks are explained by management.

Jon

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 01:32 PM

McGrath, I have to disagree with you on your thoughts regarding the millenium virus and think that many computer workers must have emerged with great credibility through thoroughly checking thier sytems to ensure that there were no problems.

Whether the people who did this work were the ones that seemed to make all the noise, jump on a bandwagon and apparently make a lot of money, is of course a different matter.

Jon

Subject: RE: Tech: Despicable Virus Alert
From: Willie-O
Date: 09 May 00 - 01:20 PM

Unfortunately McGrath is right. I was sent the ILOVEYOU virus from an in-laws work computer--fortunately I had heard about it on the radio ten minutes earlier--but the message would have made me suspicious anyway since it sure as hell didn't sound like my wife's cousin's husband...but like most users I didn't know what a .vbs extension meant back then.

when the little dickheads (in this case petty criminals who were aparently trolling for psswords,) are realizing from this is that to make a virus really dangerous, it has to be believably packaged--what they call "social engineering". ILOVEYOU was a pretty primitive effort on that front, but apparently thats all it took.

Thanks for the list Amos.

Willie-O

Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow
Date: 09 May 00 - 01:09 PM

Watching computer gurus being interviewed about this on the news I got the feeling they were chortling inside. It puts them back in businesss again, after the failure of the Millenium Bug to bring the end of civilisation lost them such a lot of credibility.

Being cynical about such things, I believe we can anticipate that this kind of thing is going to crop up periodically, any time the gurus need a bit of favourable media attention.

Next thing, I imagine, will be variants where the message it sends is more likely to fool people into thinking it's a real message from the person it says it's from - or even some clever gizmo that attaches the attachment to a real message, replacing the attachment that you were meaning to send, the next time you send an attachment...

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 09 May 00 - 01:04 PM

I have finaly got my latest virus InoculateIT update. I haven't been able to get it to download since this scare came out.

Regards opening a file marked .vbs, I have been very suspicious for some time and think I would not have opened one without knowing why I had recieved one, regardless of the sender, long before this current problem cropped up.

As I have said before, we can all get caught (and I sometimes open things that maybe I shouldn't) but in some ways, caution on our part is better protection than the anti-virus software as they have to catch up the new ones as they are written.

Jon

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 09 May 00 - 12:20 PM

It probably calls for frequent updates to a monitoring file or something like that. Same thing happens in some systems when virtual memory or tracking recently used items is turned on -- it's probably just a lot of disk access going on. It cuts your performance a little but for normal home use it won't be noticeable mostly aside from the clicks.

A

Subject: RE: Tech: Despicable Virus Alert
From: katlaughing
Date: 09 May 00 - 11:59 AM

Thanks, Amos! BTW, have any of you who use ZoneAlarm noticed a faint click from your hard drive when it is in use? It is really annoying and constant. When I disable ZoneAlarm I don't hear it anymore. Any ideas?

Thanks,

katwhoseputersoundslikeatickingtimebomb!

Subject: RE: Tech: Despicable Virus Alert
From: Amos
Date: 09 May 00 - 11:52 AM

The following summarizes eight known variants:

   ANSIR E-MAIL - National Infrastructure Protection Center (NIPC) Alert
   00-041d (LOVE-LETTER-FOR-YOU) Also known as the LOVE BUG VIRUS and
   variants;

   UPDATE as of 2000 (EST) 7 May 2000
   As of 7 May 2000, at least eleven variants of the LOVE BUG worm have
been   identified.  These variants may behave differently than the original
worm   and may impact different files.  Preliminary information on variants
is   provided below:

   A.    VBS.LoveLetter.A
         Attachment:     LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        ILOVEYOU
         Message Body:   kindly check the attached LOVELETTER coming from me.
 
   B.    VBS.LoveLetter.B (also known as Lithuania)
         Attachment:     LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        Susitikim shi vakara kavos puodukui...
         Message Body:   kindly check the attached LOVELETTER coming from me.
 
   C.    VBS.LoveLetter.C (also known as Very Funny)
         Attachment:     Very Funny.vbs
         Subject:        fwd: Joke
         Message Body:   (empty)
 
   D.    VBS.LoveLetter.D (also known as BugFix)
         Attachment:     LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        ILOVEYOU
         Message Body:   kindly check the attached LOVELETTER coming from me.
 
   E.    VBS.LoveLetter.E (also known as Mother's Day)
         Attachment:     mothersday.vbs
         Subject:        Mothers Day Order Confirmation
         Message Body:   We have proceeded to charge your credit card for the
         amount of $326.92 for the mothers day diamond special. We have   attached
         a detailed invoice to this email. Please print out the attachment   and
         keep it in a safe place.  Thanks Again and  have a Happy Mothers   Day!
 
   F.    VBS.LoveLetter.F (also known as Virus Warning)
         Attachment:     virus_warning.jpg.vbs
         Subject:        Dangerous Virus Warning
         Message Body:   There is a dangerous virus circulating. Please click
         attached picture to view it and learn to avoid it.
 
   G.    VBS.LoveLetter.G (also known as Virus ALERT!!!)
   Attachment: protect.vbs
         Subject:        Virus ALERT!!!
   Message Body: (contains a lengthy message regarding the LOVE BUG Virus)
   NOTE: This email poses as a message from Symantec Technical  Support.
   "FROM [e-mail]." This variant also overwrites files with .bat
   and .com extensions.

   H.    VBS.LoveLetter.H (also known as No Comments)
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
         Subject:        ILOVEYOU
   Message Body: kindly check the attached LOVELETTER coming from me.
   I.    VBS.LoveLetter.I (also known as Important! Read carefully!!)
   Attachment: Important.TXT.vbs
         Subject:        Important! Read carefully!!
         Message Body: Check the attached IMPORTANT coming from me!
         Misc Notes: A new comment line at the beginning: by BrainStorm /
   @ElectronicSouls. The virus also copies the files Eskernel32.vbs &
   ES32DLL.vbs, and MIRC script comments referring to BrainStorm and
   ElectronicSouls and sends a file Important.Htm to the chat room.
   J.  VBS.LoveLetter.J (New)   (Currently being analyzed)
   Attachment: Unknown
         Subject:        Unknown
         Message Body: Unknown
         Misc Notes: This appears to be a slight modification of the G
         variant
 
   K.    VBS.LoveLetter.K  (New)
   Attachment: Unknown
         Subject:        Unknown
         Message Body: Unknown
         Misc Notes: This appears to be a slight modification of a previous
         variant

Subject: Tech: Despicable Virus: Update
From: Amos
Date: 09 May 00 - 10:19 AM

Update May 9th 00:

VIRUS SPREAD LIKE WILDFIRE (Excerpt from Netscape news feed).

"The ``Love Bug'' is the most virulent computer bug ever created. Upon opening an attachment using Microsoft software such as the Outlook program, it sends a copy of the virus to everyone in the user's address book and seeks to destroy a variety of files throughout a computer network, including picture and music files.

The latest variants on the virus include tainted messages with subject lines such as Dangerous Virus Warning; Virus ALERT; How To Protect Yourself From The ILOVEYOU Bug; and >b>Thank You For Flying With Arab Airlines. "

You are probably already aware of the earlier mutation disguised as a Mother's Day gift invoice, usually for some jewelry "special"; the attachment, presented as the invoice, is actually the Visual Basic script which runs the virus.

Having spent over five hours cleaning up the mess this virus caused on one machine, you lasses and laddies, take warning from me -- don't open attachments that were built in V.B.

Norton AntiVirus software can now be updated to include Lovebug in its scans, and the definition updater can be downloaded from the Symantec site. Likewise for McAffee antiviral packages.

A

Subject: RE: Tech: Despicable Virus Alert
From: McGrath of Harlow
Date: 05 May 00 - 07:32 PM

I juast checked Amzon for "Viruses for Dummies" - I didn't find it - but there was "Virus Defence for Dummies". Out of print.

Still I suppose, if you're in the business of writing viruses, you would need to know about defence techniques, so maybe there's not a lot of difference. Lke when a government is running germ or poison gas warfare research, this always gets explained as being intended purely to help defened against germ or poison gas attacks.

Basic rule is, any time you get an attachment you haven't asked for, send an email saying "there's an email in my intray which says it's from you, with an attachment called etc etc - could you confirm that it's what it says it is?" What's difficult about that? And the other thibg kjs, once you've deleted any suspicious emails and attachments, empty the deleted file as well, just to be on the safe side.)

The thing has its funny side though - the British House of Commons got hit because some MP saw the ILOVEYOU attachment, and thought it was real and opened it. Now what kind of politician would expect to get a real "I Love You" message? (Well, Ken Livingstone might maybe, but he'd not be fool enough to trust it and open it.)

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 05 May 00 - 05:30 PM

I guess part of the problems I had with Corel Linux were that I couldn't get to the command line. The only way I could set it up involved running in a Dos folder, the Dos Loader started and I could find no way of interupting the process without comlete lock up until the KDE display manager loaded.

I had changed a grahics card and all I could get was a flashing screen even in command prompt mode (Ctr Alt F2 takes you there from the grahics from KDE). To make matters worse, the only time the keyboard input was accepted was when the screen was "on" in its flash mode. Took me ages keying in to get to XF86Config to set it back to a std VGA monitor before I was able to tell it about the ATI card...

I am still persevering with Linux and think that some of my troubles were to do with the DOS loader but things need to improve on this sort of thing.

Jon

(never a Unix user but a CP/M and DOS command line user)

Subject: RE: Tech: Despicable Virus Alert
From: Chocolate Pi
Date: 05 May 00 - 04:24 PM

I'm using LinuxPPC, doublebooting with MacOS, on an iMac. I love my Linux box very much (the OS takes up hardly any room (so I can play Quake3!); code compiles screamingly fast); however, I wouldn't reccomend it for people who want their machines to be a black box (or beige box). You do have to learn about what's really going on, instead of just pointing and clicking. There aren't ports of many popular software apps, although there's all kinds of stuff showing up on Freshmeat all the time. I suppose it is possible to run Linux as a user from an Xwindows GUI without ever having to go into command-line, but that takes all the fun out of it!

Chocolate Pi

Subject: RE: Tech: Despicable Virus Alert
From: Jon Freeman
Date: 05 May 00 - 03:57 PM

Re the Linux thought, I have tried running Corel Linux in a DOS folder and have found it less than satisfactory. I would like to pursue using Linux but feel I will need to be in a position where I am able to give it it's own partition or ideally disk drive before I can really see what it is like.

The problem here is basically that for better or worse, I know what I have under Windows and much of it works reasonably well and it would take me months (assuming I could) to make the move and find equivilant programs assuiming I could afford to.

I support the Linux move but I feel that it is impractical for many of us and regards to this forum and things I have been involved with, can not get the Java ICQ to run and hearme do not suport Hearme. I am not into the MS dominance but until I have something better that what I have now I would not be suggesting that Windows users abandon it in favour of Linux.

Jon

Subject: RE: Tech: Despicable Virus Alert
From: MMario
Date: 05 May 00 - 03:39 PM

yes, 'spaw, there is indeed such a book, and it has detailed step by step instructions on how to write a virus, worm, trojan , and just about every other nasty you can think of. And how to distribute them.

I respect the author's right under freedom of speech to write the book, however I do wish that the publisher had declined to print it and the store declined to carry it.