New Worm Virus, Navidad

Subject: New Worm Virus, Navidad
From: Steve Latimer
Date: 13 Nov 00 - 02:32 PM

I just received the following from a colleague and have checked it at Symantec, it's legit.

Please be on the lookout for a new virus called: Navidad, Spanish for Christmas. The festive malware arrives as an attachment called navidad.exe.

If executed, it installs itself in the victim's system tray, next to the clock, where it appears as an icon of a small blue eye. Clicking on the eye produces a button labeled "Nunca presionar este boton", Spanish for "Never press this button."

Victims who ignore that warning and click the button are treated to a message box with the title "Feliz Navidad", and the message "Lamentablemente cayo en la tentacion y perdio su computadora," - in English: "Merry Christmas. Unfortunately you've given in to temptation and lose your computer."

Despite its threatening tone, the program does not deliberately destroy anything on the victim's computer. But a programming error by the uncredited author causes Navidad to damage the system registry in a way that makes it impossible to execute most programs with a .exe attachment. The virus spreads by replying to messages that arrive in a victim's inbox.

www.symantec.com/avcenter/venc/data/w32.navidad.html

Subject: RE: New Worm Virus, Navidad
From: Steve Latimer
Date: 14 Nov 00 - 12:40 PM

Refresh,

Could someone do a Blueclickything to the Symantec site shown?

Subject: RE: New Worm Virus, Navidad
From: GUEST,Fibula Mattock
Date: 14 Nov 00 - 12:52 PM

Aye, it apparently is genuine, spreading by means of Microsoft Outlook.
Symantec's alert

Subject: RE: New Worm Virus, Navidad
From: Steve Latimer
Date: 14 Nov 00 - 01:04 PM

Thank you Fibula.

Subject: RE: New Worm Virus, Navidad
From: Roger in Sheffield
Date: 14 Nov 00 - 01:43 PM

If Symnatec know about it then I suppose Norton Antivirus should catch it if you update weekly?
It keeps on catching the darn Kak Worm that arrives everytime I get a certain friends emails (I have sent her the removal program but I am guessing her computer gets reinfected from elsewhere)

Roger

Subject: RE: New Worm Virus, Navidad
From: Steve Latimer
Date: 14 Nov 00 - 02:00 PM

Roger,

I got the following reply from my cousin, perhaps it will answer your question.

Thanks, Steve, but I run LiveUpdate from Symantec for Norton Antivirus 6.0 just about every week. That site you show has a fix for anyone who has already been infected, not a patch to prevent infection. Appreciate the thought.

Subject: RE: New Worm Virus, Navidad
From: katlaughing
Date: 14 Nov 00 - 02:01 PM

Thanks, Steve.

Subject: RE: New Worm Virus, Navidad
From: aussiebloke
Date: 14 Nov 00 - 02:25 PM

The folks over at Datafellows list Navidad as well.
blue clicky thing to http://www.datafellows.com/v-descs/navidad.htm
This outfit provides a freebie virus-checker called f-prot for dos, and frequent virus definition updates.

If you get into the habit of running a virus-checker over any attachment before you open it - especially *.exe and *.doc files, you'll minimise your chances of picking up a virus.

PS: To Steve - in the absence of a blue clicky thing, you can always copy (click and drag) the web-address (URL) and paste (Shift + Insert) or (Ctrl + V) it into the address line of your browser...

Cheers

Subject: RE: New Worm Virus, Navidad
From: Mrrzy
Date: 14 Nov 00 - 02:37 PM

Thanks; I've sent this over to my Helpdesk folks, hope it saves us all some grief! Will let you know if that finds out anything else... but I kinda like this one, it's almost cute, or would be if it really didn't do anything other than threaten you for disobedience!

Subject: RE: New Worm Virus, Navidad
From: MMario
Date: 14 Nov 00 - 02:46 PM

of course it's a real one. If it wasn't, there would have been about 18 gazillion posts and e-mails about it.

"If you get into the habit of running a virus-checker over any attachment before you open it - especially *.exe and *.doc files, you'll minimise your chances of picking up a virus."

I could not agree more. with the following addition - I would say .exe and ANY MS-office (.xls, .ppt, .doc, .ddb )or VISUAL BASIC files(.vb*)

Subject: RE: New Worm Virus, Navidad
From: Roger in Sheffield
Date: 14 Nov 00 - 02:46 PM

aussiebloke the worm virus I keep getting does not arrive as a seperate attachment, it 'hides' in the message itself. so I get an email from Maree (no attachments) and when I click on the email to read it the antivirus software kicks in with a warning message and gives me some options. If it got onto my computer unnoticed it would then attach itself to outgoing emails to spread further.

Subject: RE: New Worm Virus, Navidad
From: GUEST,Uncle Jaque
Date: 14 Nov 00 - 04:20 PM

Yup: It's legit, all right; here's the skinny from the SYMTECH (NORTON) Site:
W32.Navidad Discovered on: November 3, 2000 Last Updated on: November 11, 2000 0 9:38:15 PM PST

W32.Navidad is a mass mailing worm program. The worm replies using MAPI to all Inbox messages that contain a single attachment. This works with Microsoft Outlook. The worm utilizes the existing email subject line and body and attaches itself as NAVIDAD.EXE. Due to the bugs in the code, after being executed, the worm causes your system to be unusable.
It is listed on top of their highest risk list, but a "fix" and update is available. Apparantly, as with many of these E-mail Worms, MS Outlook Express is particularly vunerable. For what it's worth, a Tech Support type advised that EUDORA E-mail server is essentially immune to these boogers, as it does not use MS protocols, or something... I got a "lite" trial version, and it's OK.

Subject: RE: New Worm Virus, Navidad
From: Catrin
Date: 14 Nov 00 - 05:22 PM

This is really creepy. I use Hotmail - so I can access it from wherever and don't bother with outlook at all. If I get a weird looking email, I generally delete it without opening it. I have just deleted one (before noticing this thread) Which was entitled (something like) (?) worm - happy christmas. I think I'm glad I did!

I also use Macafee Antivirus programme, which is the same one used by Manchester University, I did a virus check yesterday and found that I had picked upa virus called 'removeit js/seeker' - which I instantly deleted. I have no idea how it get there - I looked it up on Macafee's info site. They describe it as a 'trojan'. Not sure what that means though.....

Subject: RE: New Worm Virus, Navidad
From: Jon Freeman
Date: 14 Nov 00 - 05:43 PM

Catrin, a trojan is different to a virus in that it does not spread. It could be a seemingly innocent program like a game that is doing nasty things to your computer while you are enjoying playing the game..

I have mentioned this one before but I use InoculateIT Personal Edition which is another free anti-virus program that provides free updates. It is available from Computer Assosciates athttp://www.cai.com.

Jon

Subject: RE: New Worm Virus, Navidad
From: GMT
Date: 15 Nov 00 - 04:19 AM

We have some cases here at the University. Apparently it disables the virus checker straight off then does its dastardly stuff.

I'm not an expert but it has disabled a pc in the office next to me, and out computer centre staff have just left it switched off.

Cheers
Gary

Subject: RE: New Worm Virus, Navidad
From: Roger in Sheffield
Date: 15 Nov 00 - 12:13 PM

Thanks Jon I will pass that info onto Maree
Roger

Subject: RE: New Worm Virus, Navidad
From: PatJoe
Date: 16 Nov 00 - 12:20 PM

If this new Worm virus is a Visual Basic script files, as many recent ones are, it will only work if Scripting is enabled in Outlook.

Script files are lists of computer instructions that were developed to work with the internet, recently Microsoft extended scripting to work in Outlook, and you can see the effect. Outlook 98 and 2000 are generally installed with Scripting enabled. The older versions of Outlook do not allow script files to execute and are safe from such viruses.

To disable scripting; open Outlook; Click Tools on the menu bar at the top of the screen; click Options, click the Security tab on the window that appears; click the Zone Settings button on the lower half of the window; click the OK button on the warning that shows up; Click the Custom Level button at the bottom of the window (don't click the internet icon or any of the other icons); then go down the drop down list of settings to the Scripting section and set the "Active Scripting" option to disable, click the Reset button and click OK. You can only reset one option at a time, if you wish to disable "Allow paste operation via script" and "Scripting of Java applets" as I did. You will need to the repeat the steps beginning with clicking the Custom Level button for each option.

To see if the scripting options are permanently disabled check the Scripting the next time you start Outlook.

I disabled Outlook scripting and have noticed no adverse effects. There doesn't seem to be a practical reason to allow script files to execute in Outlook, at least any that I can think of. However if need be the option can be reset or set to prompt in the same manner as it was disabled.

PJ

Subject: RE: New Worm Virus, Navidad
From: GUEST,JTT
Date: 16 Nov 00 - 03:17 PM

Apparently Windows Millennium Edition's System Restore feature is causing problems for people who catch viruses, because it keeps putting back the viruses cleaned out by their virus software.

According to an email sent to me, the correct thing to do if this is happening to you is to shut off System Restore in your Control Panels\System\Troubleshooting\Disable System Restore, then reboot and virus-check, then switch System Restore back on.

Of course, you should also check any zip disk backups and so on.

Subject: RE: New Worm Virus, Navidad
From: GUEST,Lindsay
Date: 17 Nov 00 - 04:27 PM

I know of no email program that spreads any virus by itself. Attachments are a different story. While this virus might be sent primarily through Outlook, it might simply be because of how widespread Outlook is.

Before anyone takes exception to my statements, I have been an email administrator for DaVinci, MS Mail, ccMail, Exchange, and several others for about 10 years now. Call it my trigger point that I have a problem with blaming the email software rather than the creator of the virus.

BTW, I commend those of you who do not open attachments willy-nilly and still try to help those who don't know any better.

Lindsay

Subject: RE: New Worm Virus, Navidad
From: MMario
Date: 17 Nov 00 - 04:38 PM

on the other hand lindsay - if you are honest you will admit there are "trojans" that spread only via certain software - of which outlook is one; exchange another; ms mail a third.

just as there are macro-viruses that only affect those using microsoft office.

Subject: RE: New Worm Virus, Navidad
From: GUEST,JTT
Date: 18 Nov 00 - 04:55 AM

Lindsay, I didn't open the attachments. I'm using Eudora 5. I have the Microsoft Viewing Pane switched off. I have my view in Windows Explorer set to show full paths, so I could see that these viruses were .doc.pif and .mp3.pif.

This is what happened: as I was downloading my mail - before I even saw the virus mails - Norton AntiVirus came up with a notice saying a virus was present. I immediately quarantined it. When the mail was downloaded I went searching through the filtered mailboxes and found the two mails in one. I clicked on them to open them - *not to open the attachments*, mind, just to open the mails.

After that, every few days I'd get another notice from Norton saying a file was trying to run malicious code.

It's a mystery to me how these files executed. The emails themselves were blank - the address was [e-mail], but there was nothing in the mails themselves, just the attachment icons, which I left strictly alone. And I didn't go into them in Explorer, either, simply let Norton quarantine them immediately.

Subject: RE: New Worm Virus, Navidad
From: GUEST,utai84_anti virus
Date: 21 Sep 04 - 08:27 PM

i was very dissapointed because the virus attack my computer.i had formatted my computer for second time.can all of you help me how to distroy the virus.the virus name worm/verona.if that virus very dangerous

Subject: RE: New Worm Virus, Navidad
From: Joe Offer
Date: 21 Sep 04 - 10:16 PM

Hi - yes, you have a big problem. The Verona worm has many names, and it looks like it's difficult to remove. You'll find removal instructions from Symantec/Norton AntiVirus here (click). Good luck.
-Joe Offer-