Tech: new virus attachment

Subject: Tech: new virus attachment
From: fretless
Date: 26 Jun 03 - 01:57 PM

Received warning this AM about a new bug...as well as about a dozen messages witht the zip file/virus attached. Time to hit the delete button!

The latest in a family of Sobig worms is loose on the Internet. Sobig.e (w32.sobig.e@mm) arrives by e-mail with an attached file and also spreads using shared network files. Unlike previous variations of Sobig, this one uses subject headings borrowed from Sobig.c and only one attached filename, making it somewhat easier to recognize. Sobig.e affects only Windows users. Once executed, however, Sobig.e will attempt to send copies of itself via its own SMTP engine. It will also attempt to download Trojan horse files from a Web site. Sobig.e is self-terminating and will spread only until July 14, 2003. Because Sobig.e spreads via e-mail and network share and may steal personal information such as passwords, this worm rates a 6 on the ZDNet Virus Meter

Subject: RE: Tech: new virus attachment
From: McGrath of Harlow
Date: 26 Jun 03 - 01:59 PM

So if we make a point of not opening attachments can we relax about this one?

Subject: RE: Tech: new virus attachment
From: fretless
Date: 26 Jun 03 - 02:05 PM

That's my understanding. The attachments come as zip files, and the nasty part of this one appears to be that it can steal addresses and arrive as a message from a familiar source.

Subject: RE: Tech: new virus attachment
From: Geoff the Duck
Date: 26 Jun 03 - 02:27 PM

Here's a BLICKY to Symantec's virus warning page http://securityresponse.symantec.com/avcenter/venc/data/[e-mail].
Quack!

Subject: RE: Tech: new virus attachment
From: Geoff the Duck
Date: 26 Jun 03 - 02:59 PM

According to Symantec the virus to leaves a file named msrrf.dat on your C:\ drive. If you do a search and find the file present I presume you are infected. Likewise I assume that if the file isn't found your system is clean of this particular virus.
GtD.

Subject: RE: Tech: new virus attachment
From: SeanM
Date: 26 Jun 03 - 03:00 PM

Standard warning - only accept attachments from a trusted source whom you *know* is sending you the attachment, and even then only open it *after* you've run it through an updated virus scanner.

M

Subject: RE: Tech: new virus attachment
From: GUEST,jennifer
Date: 26 Jun 03 - 04:36 PM

I was dumbfounded to read on the Hotmail pages for "dealing with spam" the instructions "do not send attachments [to the spam reporting address] as we cannot open them, open the attachment and cut and paste the contents". Is this incredibly stupid or have I missed the point somewhere? Having gone through all their ideas I went back to just putting up with it.

Jennifer

Subject: RE: Tech: new virus attachment
From: Joe Offer
Date: 26 Jun 03 - 04:45 PM

Hi, Jennifer - They're right. Attachments are annoying, a problem to open, and risky. There's no reason you can't highlight the text of whatever, copy it, and paste it into the text of your e-mail message.
I often get e-mails from people who forward other e-mails to me as attachments. I routinely delete them.
If they're too lazy or not smart enough to know how to copy-paste, whatever they're sending me probably doesn't have much value, either. And they're probably not smart enough or careful enough to be able to avoid sending me a virus.
-Joe Offer-

Subject: RE: Tech: new virus attachment
From: Willie-O
Date: 26 Jun 03 - 05:54 PM

Um. Joe, I think what Jennifer thinks is stupid is if people interpret that instruction to mean "open the attachment that you think carries a virus", which is obviously not a good idea.

Maybe what they really mean at Hotmail, and are not clear enough about is "don't send us attachments, period, because we are security-conscious like Joe and will just delete them."   

W-O

Subject: RE: Tech: new virus attachment
From: Mr Red
Date: 26 Jun 03 - 06:11 PM

I'm with you Joe but - is there not an automated process whereby forwarded e-mails get encapsulated. May be a Unix app or mac or obscure PC app but when there are people who can argue that my site contains errors (as if!) while I argue those data are not on my site and they don't even know that when the visual syntax changes it ain't me ...... well it is no surprise that viruses spread.

There is always A/V. Though I went looking for info on the Symantec site and spotted a blahblah@.dodab virus that effectively wiped Norton.   leaves ya real confident - right?

Subject: RE: Tech: new virus attachment
From: JennyO
Date: 29 Jun 03 - 05:00 AM

My viruscan automatically updates regularly, and a couple of weeks ago it picked up SobigA in my email and automatically deleted it. So I imagine it will pick up the new one. Still I'll be watching out.

That virus you mentioned, Mr Red, sounds really horrible. How can it wipe Norton?

Jenny

Subject: RE: Tech: new virus attachment
From: treewind
Date: 29 Jun 03 - 01:55 PM

Spam and viruses aren't the same thing. Not that I'm suggesting that spam never contains a virus, so Hotmail's advice (if I've understood right) is very dangerous. But I think their intention is that you send them the text from stuff like HTML-formatted attachments (I get a lot of SPAM in HTML only). This is still really bad advice. Even opening an HTML message can create security problems, like silently sending your email address to a web site somewhere, or downloading a javascript that exploits a weakness in Outlook/OE.

Anyway, if you want to report spam to someone who might be able to do anything about it they will need the headers, not the contents of the message. With a bit of luck, they show the route it's taken over the net.

Mr Red - viruses that try to destroy AV programs have been around for many years. Nothing new about that.

Anahata

Subject: RE: Tech: new virus attachment
From: LesB
Date: 29 Jun 03 - 02:10 PM

I've been bombarded with e-mails containing W32 Bugbear D Virus. My BT account intercepts it and sorts it before telling me.

Les