[b-greek] RE: Virus

From: David C. Hindley (dhindley@compuserve.com)
Date: Wed Dec 05 2001 - 12:03:45 EST


gfsomsel [polycarp66] said:

>>Due to Wayne's posting I went to the URL listed and ran the scan. I
was amazed to find that it said that I had 6 infected files. There is
also a downloadable program on Symantec's site called
"FixBadTrans.exe." I downloaded and ran this. It stated I was NOT
infected. Who knows?? Well,
better safe than sorry.<<

I had received a couple of messages 12/1-3 that seemed odd. When I
tried to open them the computer displayed a message saying that it
could not download a file from a web link. The file name and URL were
all gibberish letters, but identical in both messages.

Contacting McAfee, my virus protection vendor, I learned that the
messages had both variants of the virus, one in each message. Luckily
the trojans were in the attachments, and not infecting the computer.
However, I had not even tried to open the attachments, so the message
that it could not be downloaded baffled me. If I scanned individual
highlighted messages inside Outlook98, I was told their attachments
were infected, but the attachment resisted "cleaning." If I did a full
blown system scan from the McAfee main menu, even when the program was
set up to scan all file types, it said there were no infected files. I
do not think my computer was infected, but it goes to show that
sometimes virii can be difficult to diagnose and root out.

Both messages were in HTML format, and this has been known to leave
users open to attack in earlier versions of Outlook98 and/or IE than I
had. It appears that the HTML code had a hidden instruction to open a
link to an URL. Luckily, my software was unable to process the command
or some security settings made it impossible. I wonder too whether the
URL it was seeking had simply been shut down already, and it could
have happened to me too.

Scary, isn't it?

Respectfully,

Dave Hindley
Cleveland, Ohio, USA



---
B-Greek home page: http://metalab.unc.edu/bgreek
You are currently subscribed to b-greek as: [jwrobie@mindspring.com]
To unsubscribe, forward this message to leave-b-greek-327Q@franklin.oit.unc.edu
To subscribe, send a message to subscribe-b-greek@franklin.oit.unc.edu




This archive was generated by hypermail 2.1.4 : Sat Apr 20 2002 - 15:37:13 EDT