Possible e-mail virus??

djprescott · Post by **djprescott** » Tue Jan 27, 2004 4:45 pm

I have just received an email with an address biffa@carvoeiro.org which contains no text but has an attachment titled body.exe.

As it is an exe file I am very suspicious and have therefore not opened it up. Just letting everyone know just in case. Dave.

Rob · Post by **Rob** » Tue Jan 27, 2004 4:51 pm

djprescott wrote:I have just received an email with an address biffa@carvoeiro.org which contains no text but has an attachment titled body.exe.

As it is an exe file I am very suspicious and have therefore not opened it up. Just letting everyone know just in case. Dave.

Hi, U should be careful for today I received a body.zip file in my mail box. This file contained a virus so I'd suggest not to open it!

cheers
Rob

Michael Crane · Post by **Michael Crane** » Tue Jan 27, 2004 5:12 pm

So far today Norton has stopped 24 virus attacks on my PC!

Michael Crane · Post by **Michael Crane** » Tue Jan 27, 2004 5:17 pm

Just been attacked again. This is the virus that's having a go at me: w32.novarg.a@mm

Look at the Norton web site for details:
http://securityresponse.symantec.com/av ... .a@mm.html

biffa · Post by **biffa** » Tue Jan 27, 2004 6:23 pm

Strange cos this Biffa hasn't used carvoeiro.org at all

Maybe I am being cloned?

ANDY · Post by **ANDY** » Tue Jan 27, 2004 6:31 pm

We have today had over 24 virus's from:
postmaster@infiniteenergy.com, norton has picked it up everytime!! watch out guys!

biffa · Post by **biffa** » Tue Jan 27, 2004 6:41 pm

Virus: W32/MyDoom-A

Aliases
Mimail.R, Novarg.A, Shimg, W32.Novarg.A@mm, W32/Mydoom@MM

Type
Win32 worm

Description
W32/MyDoom-A is a worm which spreads by email. When the infected
attachment is launched, the worm harvests email addresses from address
books and from files with the following extensions: wab, txt, htm, sht, php,
asp, dbx, tbb, adb and pl.
W32/MyDoom-A creates a file called Message in the temp folder and runs Notepad to display the contents, which displays random characters.

W32/MyDoom-A uses randomly chosen email addresses in the "To:" and
"From:" fields as well as a randomly chosen subject line. The emails
distributing this worm have the following characteristics.

Subject lines
error
hello
hi
mail delivery system
mail transaction failed
server report
status
test
[random collection of characters]

Message texts
test
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.

Attachment filenames
body
data
doc
document
file
message
readme
test
[random collection of characters]

Attached files will have an extension of BAT, CMD, EXE, PIF, SCR or ZIP

djprescott · Post by **djprescott** » Tue Jan 27, 2004 7:13 pm

Hi, I also had an email today with one of my customers domain name with message.zip, presumably from a similar source. I wasn't suggesting it had orinated from this site, by the way, I just wanted to make people aware. The .org extension alerted me to this fact.
Dave.

biffa · Post by **biffa** » Wed Jan 28, 2004 12:08 am

The file name body.exe is a bad one as shown on previous post taken from the Sophos anti virus web site

Francoise · Post by **Francoise** » Wed Jan 28, 2004 1:02 am

can anyone translate this into English or even French! for me please/ s'il vous plait?

Gerry Cullen · Post by **Gerry Cullen** » Wed Jan 28, 2004 1:20 am

Does this mean that i max out the credit card ?or Pray?

Gerry Cullen · Post by **Gerry Cullen** » Wed Jan 28, 2004 1:36 am

Being serious| many thanks to all of you who took the time to warn us on this, some of these posts took a bit of time and even though i don,t understand it all i,m greatful for your efforts,
gerry

Guest · Post by **Guest** » Wed Jan 28, 2004 1:27 pm

Gerry, my pc cillin antivirus software flashes Congratulations when it hasnt found a virus doing its check which makes me very

- can be the highlight of my week actually

So what does it say when it has found a virus??-- U R F*****!??

Gerry Cullen · Post by **Gerry Cullen** » Wed Jan 28, 2004 11:20 pm

by the way there was a spot on the irish news about this new bug,seems to be serious shit as one of the software cos is offering250,000e reward for info be carefull out there

petermeachem · Post by **petermeachem** » Thu Jan 29, 2004 11:57 pm

The reason for that Gerry is that the virus will use infected pc's to attack SCO (a Unix firm) between the 1st and 13th of Feb. SCO are currently demanding royalties from Linux, which may well be pertinent. Apparently 1 in 12 emails are currently the virus and quite a lot more are AV programmes and Mail Servers sending mail back to where the virus says it came from to say 'Oh I found a virus'. As the virus invents the From address, this is a complete waste of time, they are just using it as an excuse for advertising. I cleared just under 200 copies off a customers mail server today, it seems the worst is over, just a few new ones have turned up.

Possible e-mail virus??

Possible e-mail virus??

Re: Possible e-mail virus??

Virus

Virus