Virus Alert: Email attachment including "Snow White and the Seven Dwarves.."

[mudoggy]

".. the REAL story."

It alludes that there is a screensaver .scr file attached (at least the version I received).
http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html

I found it interesting that both myself and my wife received this email. The only place I can think of that we both surf to is Ebay. I don't think it was a "shotgun" message to a block of IP's since my other email account wasn't hit. Therefore, someone is harvesting email addresses from somewhere, or it's someone we both know (I don't think the latter is very likely).

Just wanted to drop a line to you all.
Glad my Norton NIS/NAV is updated and caught it, twice! http://sysopt.earthweb.com/forum/smile.gif

Do those virus/engine updates, people!!!!!!!

[Roy]

I received it too. Mabye a SysOpt Troll? http://sysopt.earthweb.com/forum/frown.gif

[Underclocked]

It's been running wild in this area. Pretty obnoxious delivery. Lookout for anything that starts HAHAHA .

[Barney]

I know a lot of people who got it. They all use hotmail. I never got it and I use an email adress from homestead.

Hotmail is the best place to pick up the newest virusses!

Ronald

[nodnerb2]

Hi,
Just thought I'd add this.
I started to receive a load of junk mail including on that was after my password all of a sudden. This began about the time I first came to Sysopt. I could understand if it was all coming to my e mail address posted here but it wasn't it is coming to another one that to the best of my knowledge I have never used at all. I just got it because I have the same one at another ISP and was planning on changing ISP's

Wierd don't ya think?

Nodnerb2

[randy48]

That virus attaches itself to a users address book if they open the file. Each time that person sends an e-mail, the virus is resent to everyone in the address book. It updates itself from a usenet account frequently. You can find out which ISP it's coming from by right clicking on the message in OE, click properties, details, and then message source. Right click and select all, right click and copy. Go to SpamCop: http://spamcop.net/nosend.shtml
paste the message in the box, wait several seconds and it will come up with the senders ISP. It will not tell who send it http://sysopt.earthweb.com/forum/frown.gif Check your address book, and inform anyone that matches that if they opened the HAHAHA message, they've got the virus.
Here's info on the virus and also a fix (if the infected machine isn't too far gone: http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html

[Biff]

Yeh, I got that in early December along with 2 other varients. Not at my e-mail address posted at sysOpt, but through another address.

[mudoggy]

Yes, I forgot to mention that the sender line said "HAHAHA".

I've heard of a couple of other people in my circle of acquaintances have received it as well.

I must admit the spread of these things is somewhat fascinating.

[Darvocet]

Indeed this is one of those nasty email virii that attaches itself to email and disguises who the real sender is. The source code includes a URL to a virus creation website (I forget which one) and some nicks for the shoutz to other hackers. Also if you go to http://www.sexyfun.net you will find not a porn site but a rather informative page about the virus and ways to get rid of it if you opened the attachment.

[Biff]

So how do you find out who actually sent it, and more to the point - get even.

[MadMatt]

We got hit with it at work today.

I'm constantly amazed that allegedly intelligent people (PhD's, MBA's, etc) will blindly open these messages.

I'm more amazed that a well page sys admin will forget (FOR TWO WEEKS!) to push out the latest virus definitions....

DOH!

[tepo]

I once (few months ago) tracked down the sender and reported it with original message and my W2K's logfiles to his/hers ISP. Nothing happened...

Tepo

PS: I just love NAV... http://sysopt.earthweb.com/forum/smile.gif