DEVON-L Archives

Archiver > DEVON > 2001-05 > 0988815826


From: Vicki Lindsay Thauvin <>
Subject: [ADMIN] BadTrans virus message
Date: Wed, 2 May 2001 08:03:46 -0700


Hello,

I'm borrowing this text from another list administrator (Geoffry
Stone) with his approval and text modifications. <G> I believe he
explains this virus better than I can and probably in a nicer way.
<G>. I'm sending this message for two reasons: 1) to trigger the bad
trans virus from subscribers and 2) Keep people updated.

Please do not reply to this message via the DEVON list. Reply to me
personally, .


-- Message ---

The BadTrans virus has now been around for nearly three weeks and at least
it is possible to know who is infected, since it is posted from somebody
possibly known to the recipient. This virus [or Worm] sends emails in
reply to those already in the victims inbox. Thus they look genuine, but
simply have a message like Take a look at the attachment. The sender is
not aware that this has happened.


I will repeat what has been said before:-

You cannot receive any virus through a Rootsweb list.

Rootsweb will reject any attachment and bounce it to the Listowner. This
of course means that Listowners are particularly vulnerable to receiving
new viruses.

The virus may look as though it came from the list, but it didn't.
However, it may well have come from a list member. The offending BadTrans
attachment will usually have any one of the following names:-

Pics.ZIP.scr
images.pif
README.TXT.pif
New_Napster_Site.DOC.scr
news_doc.scr
hamster.ZIP.scr
YOU_are_FAT!.TXT.pif
searchURL.scr
SETUP.pif
Card.pif
Me_nude.AVI.pif
Sorry_about_yesterday.DOC.pif
s3msong.MP3.pif
docs.scr
Humor.TXT.pif
fun.pif
and other *.pif files

If you find one of these file names with incoming mail then delete it
immediately, don't click on it or attempt to read it.
Do not attempt to rename it or to do anything else since those with two
dots in the name are very dangerous. Windows will rename part of the name
and leave the pif or scr extension untouched, thus leaving a time-bomb.

Take a look to the attachment.

This rather gives the game away that the originator of the virus was not
English speaking as his first language.

That is all I wish to say on the subject.

Take care and be very careful with attachments. Update your Anti-virus
software.

Regards,

Vicki

Any comments to me please at


--
Vicki Lindsay Thauvin <mailto:>

This thread: