Subject: Tech: Despicable Virus: Update From: Amos Date: 09 May 00 - 10:19 AM Update May 9th 00: VIRUS SPREAD LIKE WILDFIRE (Excerpt from Netscape news feed).
"The ``Love Bug'' is the most virulent computer bug ever created. Upon opening an attachment using Microsoft software such as the Outlook program, it sends a copy of the virus to everyone in the user's address book and seeks to destroy a variety of files throughout a computer network, including picture and music files.
The latest variants on the virus include tainted messages with subject lines such as Dangerous Virus Warning; Virus ALERT; How To Protect Yourself From The ILOVEYOU Bug; and >b>Thank You For Flying With Arab Airlines. " You are probably already aware of the earlier mutation disguised as a Mother's Day gift invoice, usually for some jewelry "special"; the attachment, presented as the invoice, is actually the Visual Basic script which runs the virus. Having spent over five hours cleaning up the mess this virus caused on one machine, you lasses and laddies, take warning from me -- don't open attachments that were built in V.B. Norton AntiVirus software can now be updated to include Lovebug in its scans, and the definition updater can be downloaded from the Symantec site. Likewise for McAffee antiviral packages. A |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 09 May 00 - 11:52 AM The following summarizes eight known variants: ANSIR E-MAIL - National Infrastructure Protection Center (NIPC) Alert UPDATE as of 2000 (EST) 7 May 2000 A. VBS.LoveLetter.A H. VBS.LoveLetter.H (also known as No Comments) |
Subject: RE: Tech: Despicable Virus Alert From: katlaughing Date: 09 May 00 - 11:59 AM Thanks, Amos! BTW, have any of you who use ZoneAlarm noticed a faint click from your hard drive when it is in use? It is really annoying and constant. When I disable ZoneAlarm I don't hear it anymore. Any ideas? Thanks, katwhoseputersoundslikeatickingtimebomb! |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 09 May 00 - 12:20 PM It probably calls for frequent updates to a monitoring file or something like that. Same thing happens in some systems when virtual memory or tracking recently used items is turned on -- it's probably just a lot of disk access going on. It cuts your performance a little but for normal home use it won't be noticeable mostly aside from the clicks. A |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 01:04 PM I have finaly got my latest virus InoculateIT update. I haven't been able to get it to download since this scare came out. Regards opening a file marked .vbs, I have been very suspicious for some time and think I would not have opened one without knowing why I had recieved one, regardless of the sender, long before this current problem cropped up. As I have said before, we can all get caught (and I sometimes open things that maybe I shouldn't) but in some ways, caution on our part is better protection than the anti-virus software as they have to catch up the new ones as they are written. Jon |
Subject: RE: Tech: Despicable Virus Alert From: McGrath of Harlow Date: 09 May 00 - 01:09 PM Watching computer gurus being interviewed about this on the news I got the feeling they were chortling inside. It puts them back in businesss again, after the failure of the Millenium Bug to bring the end of civilisation lost them such a lot of credibility.
Being cynical about such things, I believe we can anticipate that this kind of thing is going to crop up periodically, any time the gurus need a bit of favourable media attention.
Next thing, I imagine, will be variants where the message it sends is more likely to fool people into thinking it's a real message from the person it says it's from - or even some clever gizmo that attaches the attachment to a real message, replacing the attachment that you were meaning to send, the next time you send an attachment...
|
Subject: RE: Tech: Despicable Virus Alert From: Willie-O Date: 09 May 00 - 01:20 PM Unfortunately McGrath is right. I was sent the ILOVEYOU virus from an in-laws work computer--fortunately I had heard about it on the radio ten minutes earlier--but the message would have made me suspicious anyway since it sure as hell didn't sound like my wife's cousin's husband...but like most users I didn't know what a .vbs extension meant back then. when the little dickheads (in this case petty criminals who were aparently trolling for psswords,) are realizing from this is that to make a virus really dangerous, it has to be believably packaged--what they call "social engineering". ILOVEYOU was a pretty primitive effort on that front, but apparently thats all it took. Thanks for the list Amos. Willie-O |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 01:32 PM McGrath, I have to disagree with you on your thoughts regarding the millenium virus and think that many computer workers must have emerged with great credibility through thoroughly checking thier sytems to ensure that there were no problems. Whether the people who did this work were the ones that seemed to make all the noise, jump on a bandwagon and apparently make a lot of money, is of course a different matter. Jon |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 01:42 PM Yes WillieO and McGrath, I can see the psychological angle but to come back to GeorgeH's comments, I still can't help but wonder what people were doing opening such attachments within working environments such as hospitals. Surely these risks are explained by management. Jon |
Subject: RE: Tech: Despicable Virus Alert From: McGrath of Harlow Date: 09 May 00 - 01:46 PM Well, they should "have emerged with great credibility" - but the problem was they did such a good job fixing the Millennium Bug that lots of people assumed it had never been there in the first place.
Big mistake. If you're doing something difficult it can help to make a few mistakes to show people it's difficult - like streetwise jugglers do. I like to remember this when I screw up a song or a tune... |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 09 May 00 - 02:20 PM Add to the list the German variant "Sehr geehrte Damen und Herren!" McGrath, the Y2K issues was no joke, and I am still very surprised how few major catastrophes occurred; I am especially surprised that more embedded and forgotten controller ships didn't turn up with date-sensitive architecture. But I have heard enough actual reports of whole factories shutting down mid-job during remediation testing, and complex systems wrapping themselves around phone poles because the mismanaged date field was souring data transfers or forcing logical loops in whacky ways ... that I am very grateful as much remediation occurred as did. Had it not occurred, I am confident we would have inherited a lot more chaos. Also, with all due respect, computer gurus right now are not at any risk of being out of work. Over here, anyway, the unemployment rate is the lowest it has been in years and anyone competent in a technical field has a premium on his head as a desireable employee because there are so many fronts on which new technologies are being deployed. |
Subject: RE: Tech: Despicable Virus Alert From: SeanM Date: 09 May 00 - 03:05 PM Re: the Y2K glitch... It DID have some practical effects on the world, but they were covered fairly quickly. I work for a company that does a fair amount of work with credit card charges, and due to a faulty update, over a period of roughly two weeks anyone who was charged suddenly found themselves being recharged on a daily basis until the company found the bug and stopped it. As of now, I believe that they've finally fixed the problem and reversed the charges. However, it wasn't just us that got hit... The rough estimate that we heard was something in the neighborhood of 7-800,000 affected consumers. There were other smaller problems as well, that were cleared before hand. During a test a few months before New Year's at a local Waste Management facility, a computer failed to register a real alarm during the test and dumped a few hundred gallons of raw sewage into a local drainage canal. I've also heard of a few cases of the traffic grid going briefly haywire during very late night tests that they ran in Loa Angeles. As Amos more or less said, I feel we got off lucky. M |
Subject: RE: Tech: Despicable Virus Alert From: katlaughing Date: 09 May 00 - 03:21 PM Hey, would one of you *buffs* go over to the Paul G's new CD - MP3 thread and read what I posted about my computer shutting down when I tried to download files form MP3 and see what you think, PLEASE? I'd like to know if it is just me or something to do with MP3. Thanks, a bunch! kat |
Subject: RE: Tech: Despicable Virus Alert From: GUEST,Nick Jones Date: 09 May 00 - 03:50 PM Subject: FW: VIRUS ALERT Date: Wed, 26 Apr 2000 14:17:12 +0100 Subject: Virus Alert Importance: High I received this message today. Please forward it on. There is a new virus - WOBBLER. It will arrive on e-mail titled "CALIFORNIA". IBM and AOL have announced that it is very powerful, more so than Melissa, there is no remedy. It will eat all your information on the hard drive and also destroys Netscape Navigator and Microsoft Internet Explorer. Do not open anything with this title and please pass this message on to all your contacts and anyone who uses your e-mail facility. Not many people seem to know about this yet, so propagate it as fast as possible. If you receive an e-mail titled "Win A. Holiday", DO NOT open it. It will erase everything on your hard drive. Forward this letter out to as many people as you can. This is a new, very malicious virus and not many people know about it. This information was announced yesterday morning from Microsoft. Mike Johnson |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 03:53 PM Wobbler is a known hoax. Jon |
Subject: RE: Tech: Despicable Virus Alert From: MMario Date: 09 May 00 - 04:01 PM So is "Win a Holiday". Also - you can be 99.99% sure it's a hoax if the message asks you to "send it to as many people as possible" or a variation on that. |
Subject: RE: Tech: Despicable Virus Alert From: Jeri Date: 09 May 00 - 04:52 PM There's a very good place to check for hoaxes (BEFORE you e-mail all 700 people in your address book) here, at F-Secure Corporation. They also list chain letters. Folks, one rule of thumb is, it's a chain letter/hoax if it says to send it to everyone you know. I was curious about how many people these things go to. I did the math. If each person who gets it sends it to 5 people, and the mailings only happen once per day, at the end of the 10th day, the message will have been sent a total of 2,441,405 times. I'm guessing in real life, these things have a much shorter turn-around time, and people mail them to more than 5 others. I guess I don't have to wonder why the internet gets so slow at times. |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 05:52 PM Jeri, here is a puzzle for you. Put one grain of rice on the first square of a chess board, 2 on the next, 4 on the next (keep doubling). How many grains do you need to cover all the squares? Jon |
Subject: RE: Tech: Despicable Virus Alert From: Jeri Date: 09 May 00 - 06:19 PM Just a guess, but how's 73,786,976,294,838,200,000 sound? |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 06:35 PM I dnon't know if my maths are right but this logic seems to follow: one square = 1 grain, 2 = 3 grains, 3=7 grains in totlal which in each case works out as (2^Sqares)-1. By that reckoning we are looking at 2 to the power 64 - 1 which I can't calculate exactly using Excel and my C compiler is being stubborn. We had the same number of digits though. by my reckoning which may well be wrong, we are looking around 18,446,744,073,709,600,000 Jon |
Subject: RE: Tech: Despicable Virus Alert From: Jeri Date: 09 May 00 - 06:57 PM Wanna see my spreadsheet? |
Subject: RE: Tech: Despicable Virus Alert From: Jon Freeman Date: 09 May 00 - 07:05 PM Yes but lets go email from here. Either way though, it is a good example of how a simple thing and small numbers turn into mind blowing numbers in very few steps. Which I think is imortant to remember with these virus warning things. Jon |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 10 May 00 - 12:06 AM Add to your calculations re these hoaxes the manpower factor if it takes an average hoaxee, say, seven minutes to open, read, absorb, react, and forward to his five friends the Email containing the hoax. The next five people, assuming all are newbie-class, take the total up to 7 +(5x7)=42 minutes. The next wave, 42 + (7x25) = 197, or 3 hours and 17 minutes. Assuming (conservatively) 5 seconds actual relay time the ratio of linear time to wasted time after these three iterations is 21.25: 197. The wasted time, valued at a modest $15/hour for an adult professional amounts to $50 in the first 21 minutes. in the next 21 minutes this wastage multiplies: from 25 people to 125 to 625 to 3125 people. That's 3875 times 7 minutes, or 27125 minutes (452.083 hours) in the second set of three steps, valued at $6781additional. So in about 43 minutes the waste curve in terms of productive human time goes from $1.75 to $6832 cumulative waste. Draw that curve on a chart and you can see why forwarding a hoax scare without checking it can grow to a hormongous loss to the productive community world-wide. Of course this is an idealized model, but the rate it reflects is about right. A |
Subject: RE: Tech: Despicable Virus Alert From: katlaughing Date: 10 May 00 - 12:32 AM Would one of you please respond to my question about Paul G's MP3 thread and linking? Please go try it and let us all know if it is just my computer or something at MP3? Sheesh! Whadda I gotta do ta' get noticed around here amongst all them number-crunchers?!!!**BG** T'anks! kat |
Subject: RE: Tech: Despicable Virus Alert From: Escamillo Date: 10 May 00 - 12:59 AM Sorry Kat I still didn´t have the time to download the files (pretty big), will try later. Regarding hoaxes or false alerts or humanitarian requests, if someone did not see my post in another thread, I´d like to remind you that there is not only a huge loss in productive activity, there is also a more evil intention in hoaxers: in general, a long list of genuine addresses from your book gets included in your messages, as well as those being carried from previous posters, and those that the next generation will carry. These thousands of e-mails reach some PC where the hoaxers planted a TROJAN program, then it will collect them and send copies to their headquarters as soon as you connect to the Web (and of course it will never report to you what it is doing). Those lists are then sold to SPAMMERS like Aureate, Radiate and many, many others. Myself have received many offers for lists, from 80.00 to 200.00 . Please don´t redistribute anything that asks for redistribution, and don´t loose your time in checking if it is a hoax or not. I suspect those sites are not reliable. Un abrazo - Andrés |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 10 May 00 - 01:06 AM Kat -- I don't know what the bug is but at least part of it is at their end. |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 10 May 00 - 11:34 AM From ZDNet, another blanketyblamk LoveBug variant -- damn Psychos. Orignal link is over here.
New 'ILOVEYOU' worm detected See also: ZDNN's Computing section
|
Subject: RE: Tech: Despicable Virus Alert From: GUEST,CLETUS Date: 10 May 00 - 11:52 AM Miz kat, I wuzza thinkin az ta how ya mite git mor notice an all ifn you were nekkid. Then agin whut withall theez puter fellers it mite not do no good 'tall. But thet aint whut I come ta axt. Thizzeer thred sez thet thiz iz a despicable virus an I wuzza wundrin ifn thair wuz sum nice upstandin virus like one ya cud take home ta meet yer Momma? CLETUS |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 10 May 00 - 11:53 AM ZD Net also offers downloads of cures for LoveBug related attacks on this page. A |
Subject: RE: Tech: Despicable Virus Alert From: SINSULL Date: 10 May 00 - 01:23 PM Last week, someone on Mudcat warned us about "prettyparks". I can't find the thread but still want to say thank you. It showed up in our email today in the guise of a quote request but thanks to the warning and last week's horror show, no one opened it. Can't say the same for all my competitors and suppliers. Again, THANK YOU. |
Subject: RE: Tech: Despicable Virus Alert From: McGrath of Harlow Date: 10 May 00 - 03:30 PM I wonder if there are ever hoax warnings about hoaxes that don't exist? But how can you warn someone about that? I feel an infinite regression creeping up on me. Better warn people about that... |
Subject: RE: Tech: Despicable Virus Alert From: Amos Date: 10 May 00 - 03:44 PM Warning: If you don't recieve an email saying "Danger: Hoax Not Found", DON'T OPEN IT. It will send your dog to Newfoundland and rewire your truck to backfire at noon GMT, erase all your third-grade watercolors and forward your underwear to the Central Intelligence Agency. This is a little known bug which has just been announced by AOL, IBM, Motorola, Microsoft, and the Trilateral Commission. Please forward this to everyone you know so they will be safe if they don't get this terirble e-mail. A There ya go, Cletus -- take it home and give it to your Mom. But note that her penicillin won't work on this one. |
Subject: RE: Tech: Despicable Virus Alert From: SINSULL Date: 10 May 00 - 04:02 PM I thought Jeri covered that already??? McG, are you posting without reading again? You just made me go back and read it all ALL OVER AGAIN. Of course i was also stupid enough to believe that my boss sent me a love letter. |
Subject: RE: Tech: Despicable Virus Alert From: Escamillo Date: 10 May 00 - 04:02 PM Beware of ZDNet (publishers of PCMagazine). I downloaded a freeware utility from their list of "top of the week" and got a TROJAN from Aureate.com, known spammers, asking me to fill a form for "statistical purposes" and a single button "continue" without alternatives to exit. I wrote to them just to ask if they knew about these practices and got NO reply. Looking at their Privacy Policy fine print, I found that they reserve the right to give away all your personal information to whoever they consider reliable. (!!) This is NOT a hoax !:)) Un abrazo - Andrés |
Subject: RE: Tech: Despicable Virus Alert From: Bradypus Date: 10 May 00 - 07:51 PM There was a letter to the editor in today's Daily Telegraph: SIR - The episode of the "love bug" virus proves once again the truth of the old saying that the e-mail of the species is more deadly than the mail.
After McGrath's contribution to Song Challenge 26, I couldn't resist ...
|
Subject: RE: Tech: Despicable Virus Alert From: GUEST,Barry Finn Date: 10 May 00 - 08:37 PM I'm so glad I didn't bite this bug, couldn't even if I wanted too. My computer hasn't recovered from the last bite that bit it & it's been eaten up completely & if I ever get my hands on a HACKER it's straight to the shreader. Barry (whose only able to drop in now & again from work) |
Subject: RE: Tech: Despicable Virus Alert From: Jeri Date: 10 May 00 - 09:19 PM Bradypus, that is BRILLIANT! |
Subject: RE: Tech: Despicable Virus Alert From: katlaughing Date: 10 May 00 - 11:17 PM Ditto, Bradypus!! When do we get to hear you sing it? Barry Finn, sorry to hear that, but glad to know why we haven't seen much of you lately. Hope you can get a new one or something soon. Shredder, huh? That'd put you right up there with Richard Craft- the woodchipper of wife!**BG** |
Subject: RE: Tech: Despicable Virus Alert From: Escamillo Date: 11 May 00 - 07:05 AM Excellent, Bradypus! A quarter of my left eye is on TV, where a new lethal virus is being announced. I've noticed that the stupid box' alerts are always true. I think lots of imitations of the "I love you" warm are being spread out by now, and an analogy comes to my mind: If you receive 6 or 7 envelopes in your HOME mail box every day, and if you know that many bombs are circulating, and some of them have sent a neighbour to the hospital, would you open them all, including those from unknown senders, and those from known senders but which envelopes carry attractive labels ? Sorry for the insistence - I´m a programmer and make a living at this machine - Un abrazo - Andrés
|
Subject: RE: Tech: Despicable Virus Alert From: GUEST,digger Date: 11 May 00 - 12:08 PM Ahhh, the old ones are the best: WARNING! WARNING! WARNING! IF YOU RECEIVE A GIFT IN THE SHAPE OF A LARGE WOODEN HORSE DO NOT DOWNLOAD IT!!!! It is EXTREMELY DESTRUCTIVE and will overwrite your ENTIRE CITY! The "gift" is disguised as a large wooden horse about two stories tall. It tends to show up outside the city gates and appears to be abandoned. DO NOT let it through the gates! It contains hardware that is incompatible with Trojan programming, including a crowd of heavily armed Greek warriors that will destroy your army, sack your town, and kill your women and children. If you have already received such a gift, DO NOT OPEN IT! Take it back out of the city unopened and set fire to it by the beach. FORWARD THIS MESSAGE TO EVERYONE YOU KNOW! Poseidon ****************************** RE: Greeks bearing gifts Laocoon, I hate to break to you, but this is one of the oldest hoaxes there is. I've seen variants on this warning come through on other listservs, one involving some kind of fruit that was supposed to kill the people who ate it and one having to do with something called the "Midas Touch". Here are a few tip-offs that this is a hoax: 1) This "Forward this message to everyone you know" business. If it were really meant as a warning about the Greek army, why tell anyone to post it to the Phoenicians, Sumerians, and Cretans? 2) Use of exclamation points. Always a giveaway. 3) It's signed "from Poseidon". Granted he's had his problems with Odysseus but he's one of their guys, isn't he? Besides, the lack of a real header with a detailed address makes me suspicious. 4) Technically speaking, there is no way for a horse to overwrite your entire city. A horse is just an animal, after all. Next time you get a message like this, just delete it. I appreciate your concern, but once you've been around the block a couple times you'll realize how annoying this kind of stuff is. Bye now, Hector
|
Subject: RE: Tech: Despicable Virus Alert From: McGrath of Harlow Date: 11 May 00 - 01:31 PM Bradypus - you've done it again. |
Subject: RE: Tech: Despicable Virus Alert From: Stilly River Sage Date: 04 Aug 03 - 09:13 AM There's a new warning out, here is the information from Symantec. It's called W32.Mimail.A@mm and sets itself up to appear to be a message from your system's administrator telling you that your email address is about to expire. From Symantec: Uses its own SMTP server to spread by email. The email has the following characteristics: From: admin@ Subject: your account %s Message: Hello there, I would like to inform you about important information regarding your email address. This email address will be expiring. Please read attachment for details. Best regards, Administrator Attachment: Message.zip Message.zip contains only one file, Message.htm, which uses a code base exploit to create a copy of the worm named Foo.exe in the Temporary Internet Files folder, and then runs it. The compression method for this file inside the zip file is stored so that there is no compression used at all. Information about this vulnerability and a Microsoft patch is located at: http://support.microsoft.com/default.aspx?scid=kb;en-us;330994 System administrators are encouraged to apply the Microsoft patch to prevent infection by this worm. SRS |
Subject: RE: Tech: Despicable Virus Alert From: GUEST,snyds14@hotmail.com Date: 17 Oct 04 - 10:55 PM how do I get rid of freeman.vbs-notpad off my computor ??? |
Subject: RE: Tech: Despicable Virus Alert From: Cluin Date: 17 Oct 04 - 11:33 PM I don't believe it exists. Symantec has never heard of it and the only website Google turned up was a come-on. |
Subject: RE: Tech: Despicable Virus Alert From: The Fooles Troupe Date: 18 Oct 04 - 03:31 AM This was a trawl... an email address harvester. |
Share Thread: |
Subject: | Help |
From: | |
Preview Automatic Linebreaks Make a link ("blue clicky") |