Virus alert 3-1-04

Ron61 · #1 (**permalink**) 03-02-2004, 07:04 AM

I am posting this on this forum so it will appear on the main page. Last night after my virus program had updated yesterday evenig they had another update and it is criticle that you get this. When I went to my e-mail this morning I had a message in my Bulk folder.

From address was lorenav4@hotmail.com. Message just said " Your document is attached."

name of document is =" document_word.PIF"

I never heard of the sender and the pif is a tip off so I scanned it without opening it and it has the Level 4 W32.netsky.d@MM virus in the attachment.

I have two virus defination updates for 3-1 and this was in the 2nd one that they put out late last night.

Ron

Roscoe · #2 (**permalink**) 03-02-2004, 08:15 AM

I've received several of these over the last couple of days. However, my ZoneAlarm Pro (mailsafe) changes the extension from .pif to .zlo and makes it unopenable.

Roscoe

Bill V · #3 (**permalink**) 03-02-2004, 11:21 AM

Last night my Norton's AV snagged and deleted an email that was infected with the W32.Beagle as it entered my Outlook Express mailbox. I don't recall which variant it was. According to the report, the payload was compressed in a .zip file. It came from an rbuttons@ (I don't recall the domain name and why does that user name sound so familiar? Eh, it doesn't matter anyway because the sender's name is spoofed).

maxrpm · #4 (**permalink**) 03-02-2004, 12:41 PM

I'm getting at least one a day. I even got one that was a "returned as undeliverable' from the postmaster using my email address. I forwarded it to the hotmail abuse dept. & they are 'investigating' it. They say the senders are forging email addresses to the virus.

Roscoe · #5 (**permalink**) 03-02-2004, 01:02 PM

Today alone my DSL provider caught 9 virus emails:

8 Swen.A
1 Netsky.B

Yesterday there were 23 attempts:

1 Netsky.C
2 Netsky.B
2 Bagle.E
1 MyDoom.E
17 Swen.A

My DSL provider used AmikaGuardian (TM) Server to intercept viruses before I get them.

Roscoe

Roscoe

BMK · #6 (**permalink**) 03-03-2004, 03:13 AM

Hi all

I am also getting at least four or more each day. So its on over here like you cannot believe.

I started deleting any that I do not know. Don't even open them.

Have also found the returned emails and also delete them.

I am now telling everyone to make the detail clear as I dump everything I don't recognise. Particularly those that a level of urgency.

Cheers

Bernie

Ron61 · #7 (**permalink**) 03-03-2004, 06:02 AM

This is getting ridiculous. They added 5 new virus definitions last night but so far I have only had the one e-mail that got to my inbox and it was from the hotmail system. My virus scanner picked up the W32.netsky.D@MM virus in the attachment before I even looked at it. I would not have opened it anyway as it had the PIF extension, but now I look at all of the headers and everything if I get an e-mail that I am not familiar with. And that e-mail was shuttled off to the bulk folder and not left in the inbox so that was another tip off. If I get any more I am going to try and get the codes and send them to Hotmail and see if they can track them back farther. Since this worm will send itself from anyones computer it is still a good idea to scan any attachments before opening or downloading them.

Ron

vettestr · #8 (**permalink**) 03-03-2004, 08:51 AM

I have identical story as all above. After contacting ISP and server company I was told they (bad guys) are spoofing or using email address's to send spam or bugs. They fact my address book was not used as a mailing list told my ISP that I was not the main target but another ALSO SENT TO address.
This Stinks !!! be aware and be safe. Do not trust the fact it came from a known source as safe and scan everything until a cure is found.