[nukkad] YAVA (Yet Another Virus Alert) - Beware of Virus alert messages

[Sai (Indian Rediff) <>]

----------------------------------------------------------------------------
If you have knowledge, let others light their candles in it. 
-Margaret Fuller, author (1810-1850)
----------------------------------------------------------------------------



Hi all,

I have seen many a virus being sent to my innumerable
e-mail addresses. But today I saw one that was better
than all - so far.

My computer is equipped with Norton (Enterprise edition)
and it is always up-to-date (download fixes every
night). Also, since the e-mail arrived at my web e-mail
address, it required active clicking on my part to get
downloaded. I can well imagine something like this being
sent to some OE address.

The mail purportedly came from "support@microsoft.com".
And it warned of a virus as shown in the stuff between
the ***'s below.

It also carried its payload (as viruses are called) as
an attachment. The attachment was "IE_0276_Setup.exe"

There are some points to be noted. The e-mail claims to
be from Microsoft. It warns of McAfee's warning about a
legitimate virus. And it carries something that claims
to clean up your installation of IE 5.5. 

When I tried to download the attachment (just to see
what Norton would do about it), I got a warning that a
file with a virus was being written to the hard drive
and had been quarantined. *Whew*. 

But the main point is that most of us that are not SO
computer literate could easily be taken in by such
e-mails. 

The warning here is - Beware of attachments from ALL
origins - including one's that you MIGHT otherwise have
trusted.

As an addendum, let me also point you to an InfoWorld
article by Brian Livingston wherein he warns of
Microsoft itself saying that you shouldn't trust
attachments purporting to be from Microsoft.

http://www.infoworld.com/articles/op/xml/02/12/09/021209opwinman.xml

Virus writers are getting better and better. The ONLY
thing that seems to save us is good anti-virus software,
coupled with sensible Net behaviour - so far. I am not
looking forward to the day when Viruses are PUSHED onto
you with no active participation needed.


********************************************************************
From: support@microsoft.com [Save Address] [Block Sender]
To: <my e-mail address>
Cc:
Subject: Virus Alert
Date: 16 Dec 01 08:30:02

McAfee Antivirus warns about a new virus, called W32.Roro@mm.
It is a high risk worm and it's using IRC and internet pages
to infect computers. The virus deletes movies, music and
system files.

Due to the significant increase of infected users,
Microsoft Corporation, with the collaboration of
McAfee Antivirus, supports clients of Microsoft Windows
with a patch, which fixes a bug in Internet Explorer 5.5
or minor versions. This bug allows internet pages
to grant access to local resources of visitors.


-----------------
McAfee Antivirus
www.McAfee.com

********************************************************************
The full e-mail header looked as follows:
To: <my e-mail address>
Cc:
Subject: Virus Alert
Date: 16 Dec 01 08:30:02
Return-Path: 
Delivered-To: <my e-mail address>
Received: (qmail 23489 invoked from network); 16 Dec
2002 06:29:06 -0000
Received: from unknown (HELO spf11.us4.outblaze.com)
(205.158.62.43) by 205-158-62-64.outblaze.com with SMTP;
16 Dec 2002 06:29:06 -0000
Received: from spf5.us4.outblaze.com
(205-158-62-27.outblaze.com [205.158.62.27]) by
spf11.us4.outblaze.com (8.12.5/8.12.5) with ESMTP id
gBG6T0kC029567 for <my e-mail address>; Mon, 16 Dec 2002
06:29:00 GMT
Received: from saturn.internet-bg.net
(saturn.internet-bg.net [212.124.64.2]) by
spf5.us4.outblaze.com (8.12.6/8.12.6) with ESMTP id
gBG6SucZ064842 for <my e-mail address>; Mon, 16 Dec 2002
06:29:01 GMT
Received: from 212.124.64.2 (ppp218.internet-bg.net
[212.124.66.218]) by saturn.internet-bg.net
(8.12.4/8.12.4) with SMTP id gBG6JSbv020795 for <my
e-mail address>; Mon, 16 Dec 2002 08:19:29 +0200
Message-Id: 
X-Priority: 3
X-Msmail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2615.200
X-Mimeole: Produced By Microsoft MimeOLE V5.00.2615.200
X-Ravmilter-Version: 8.3.1(snapshot 20020108) (saturn) 

P.S. There is no recursion in the subject of this
e-mail. Really. I mean it. 

________________________________________________
Get your own "800" number
Voicemail, fax, email, and a lot more
http://www.ureach.com/reg/tag





------------------------------------------------------------------------------
To join/leave, use the form at: http://www.mumbai-central.com/nukkad/#options
This list is archived at: http://www.mumbai-central.com/nukkad/archive.html