Re: Virus warning

[Jeff Lane <jlane redhat com>]

Funny you should send this also to a LINUX mailing list.  Just one more
reason people should use Linux.  Win32 virii dont bother us!  <grin>

On Wed, 25 Jul 2001, Steve Fernandez wrote:

>         I found a virus on my system today, probably a new one, which
> bypassed all my antivirus software, and since all of you have your email
> ids in my address book, you all are potential targets, and so I'm
> sending this warning to you.
>
>         I received this virus twice in the past two days, from two
> people completely unknown to me. The virus selects a random subject each
> time it retransmits itself, but I've got the same message content on the
> two occasions. The message content is:-
>
>
> "Hi! How are you?
>
> I send you this file in order to have your advice
>
> See you later. Thanks"
>
>
>         After receiving this email, which has an attachment about
> 120-140 KB in size, I noticed unnecessary traffic over my internet
> connection. Also, two new threads, called Sirc32 and pstores, showed up
> on the system (does not appear in the CTRL+ALT+DEL task list) When I
> searched in my registry, I found that HKEY_LOCAL_MACHINE - Software -
> Microsoft - Windows - CurrentVersion - Run (it's in one of the Run*
> folders) has a key called "Driver32" which instructs my system to run a
> file called C:\RECYCLED\TEST.EXE (you will find two .EXE files hidden in
> your C:\RECYCLED directory) I have removed all these files from my
> system. I advise you to take a backup before you do anything.
>
> Good Luck.
>
> Regards,
> Steve Fernandez.

-- 
Jeffrey Lane, RHCX, EMT

Red Hat, Inc.  919-547-0012
www.redhat.com/support

Close the door....were you raised in a barn? Eh, you probably were raised in a
barn like all the other primatives around here
 - Ash, Army of Darkness