Hunker down people, BIG virus coming your way!!!!! **Updated with removal tools**

Page 3 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

PlatinumGold

Lifer
Aug 11, 2000
23,168
0
71
Originally posted by: ViRGE
Get the latest virus defs, pull up someone's instructions, and disinfect the machine, PG. It's not Feb 1st yet, so the DDoS attack hasn't started.

hmmm, i just installed NAV and downloaded the latest defs, will that do it?? or do i need to do it from another machine, burn to cd and then run nav from boot?
 

GtPrOjEcTX

Lifer
Jul 3, 2001
10,784
6
81
man, this ticks me off so bad. it sent itself to every member on my forums. I've been on the phone calling people, telling them to update their defs. DANG IT!!!!
 

ViRGE

Elite Member, Moderator Emeritus
Oct 9, 1999
31,516
167
106
Originally posted by: PlatinumGold
Originally posted by: ViRGE
Get the latest virus defs, pull up someone's instructions, and disinfect the machine, PG. It's not Feb 1st yet, so the DDoS attack hasn't started.

hmmm, i just installed NAV and downloaded the latest defs, will that do it?? or do i need to do it from another machine, burn to cd and then run nav from boot?
Symantec's current instructions say they can nuke this worm in normal Windows mode, so all you should need are the current virus defs to at least make yourself non-catagious. There will be a couple of registry entires still there that would point to the worm to start it up, but since the worm itself has been removed, the entries will simply be clutter, but should still be removed anyhow after the virus scanner removes the worm.
 

GtPrOjEcTX

Lifer
Jul 3, 2001
10,784
6
81
Originally posted by: ViRGE
There will be a couple of registry entires still there that would point to the worm to start it up, but since the worm itself has been removed, the entries will simply be clutter, but should still be removed anyhow after the virus scanner removes the worm.
I was just about to come back commenting after a full system scan, stating the registry entries were still there, but you beat me to it. :)
 

Kanalua

Diamond Member
Jun 14, 2001
4,860
2
81
On man, my University (BYU-Provo) sent out a mass email:

From : <univ-comm@email.byu.edu>
Reply-To : univ-comm@email.byu.edu
Sent : Monday, January 26, 2004 7:06 PM
To : *.*@elist.byu.edu
Subject : Hello

| | Trash Can | Inbox


--------------------------------------------------------------------------------

Attachment : body.zip (30 KB)

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary
attachment.

_____________

I try to open the attachment and:
W32/Mydoom@MM (ED) Virus Found

Hotmail.com stopped it!!!
 

onelin

Senior member
Dec 11, 2001
874
0
0
Anyone else find it amusing that this thing DoS attacks sco.com ?

virus info

I received a special alert through trend micro internet security 2004 tonight telling me to reboot for this update, virus defs up to date 1/26...I love automatic 3 hour updates.
 

LinuxIdiot

Golden Member
May 20, 2002
1,209
0
0
This must be the reason our corporate filter sent us like 30 warnings of incoming zip files hahaha
 

aphex

Moderator<br>All Things Apple
Moderator
Jul 19, 2001
38,572
2
91
man, i got bombarded with about 30-40 so far.... good thing i just updated my norton, catches every one...
 

RagingBITCH

Lifer
Sep 27, 2003
17,618
2
76
Getting nailed up the arse by it here at work. Our Norton is catching all of it but it's annoying as hell.
 

Sukhoi

Elite Member
Dec 5, 1999
15,350
106
106
I find it amusing that I'm getting this thing from people who shouldn't have my e-mail address...just got one from someone at unitedway.org...I've never talked to them in my life.
 

Entity

Lifer
Oct 11, 1999
10,090
0
0
I take it this would be the reason for all of the "failed delivery" messages I've been getting on messages I didn't try to send, neh? :D

Rob
 

JackBurton

Lifer
Jul 18, 2000
15,993
14
81
I had someone call up and said they opened the zip. I asked, did you run the file inside? They said yes. As a matter of fact, they kept double clicking it because the text file kept trying to load a "screen saver," but they could never read the "text" file. Mind you, THEY KEPT TRYING TO RUN THE FILE! Jesus tap dancing Christ! :|

 

Jzero

Lifer
Oct 10, 1999
18,834
1
0
Originally posted by: Sukhoi
I find it amusing that I'm getting this thing from people who shouldn't have my e-mail address...just got one from someone at unitedway.org...I've never talked to them in my life.

It's forged. Viruses are almost always forging the From address these days.
 

isasir

Diamond Member
Aug 8, 2000
8,609
0
0
Here's a question that I'm not sure about -

Some individuals at my company are getting mail from people they don't know, informing them in a text file that the virus was scanned and detected. I'm pretty sure that our system is up-to-date and secure, but since they're getting these mails, does that mean that it's possible that the virus was sent out by them (tho' not to the rest of us in the company)? Or is it more likely that somehow their e-mail address was obtained from elsewhere or spoofed?

 

Sukhoi

Elite Member
Dec 5, 1999
15,350
106
106
Originally posted by: Jzero
Originally posted by: Sukhoi
I find it amusing that I'm getting this thing from people who shouldn't have my e-mail address...just got one from someone at unitedway.org...I've never talked to them in my life.

It's forged. Viruses are almost always forging the From address these days.

I believe you on the forgery stuff. But one of them was from wviz.org, which is in Cleveland, where I'm from. How did the virus know to forge with that address? AFAIK I've never e-mailed WVIZ from the e-mail address I got the virus at. I only use that address for school stuff.
 

SarcasticDwarf

Diamond Member
Jun 8, 2001
9,574
2
76
Originally posted by: Sukhoi
Originally posted by: Jzero
Originally posted by: Sukhoi
I find it amusing that I'm getting this thing from people who shouldn't have my e-mail address...just got one from someone at unitedway.org...I've never talked to them in my life.

It's forged. Viruses are almost always forging the From address these days.

I believe you on the forgery stuff. But one of them was from wviz.org, which is in Cleveland, where I'm from. How did the virus know to forge with that address? AFAIK I've never e-mailed WVIZ from the e-mail address I got the virus at. I only use that address for school stuff.

I have one from postmaster@intel.com heh
 

Jzero

Lifer
Oct 10, 1999
18,834
1
0
Originally posted by: Sukhoi
Originally posted by: Jzero
Originally posted by: Sukhoi
I find it amusing that I'm getting this thing from people who shouldn't have my e-mail address...just got one from someone at unitedway.org...I've never talked to them in my life.

It's forged. Viruses are almost always forging the From address these days.

I believe you on the forgery stuff. But one of them was from wviz.org, which is in Cleveland, where I'm from. How did the virus know to forge with that address? AFAIK I've never e-mailed WVIZ from the e-mail address I got the virus at. I only use that address for school stuff.

It's getting the addresses from the victim's address book. The person who is infected has both your address and the from address in his address book.
 

EyeMWing

Banned
Jun 13, 2003
15,670
1
0
Originally posted by: RishiS
Here's a question that I'm not sure about -

Some individuals at my company are getting mail from people they don't know, informing them in a text file that the virus was scanned and detected. I'm pretty sure that our system is up-to-date and secure, but since they're getting these mails, does that mean that it's possible that the virus was sent out by them (tho' not to the rest of us in the company)? Or is it more likely that somehow their e-mail address was obtained from elsewhere or spoofed?

Spoofed. Both the to and from addresses are harvested from the infected computer's address book.