On Tuesday 24 July 2001 09:12 am, Shawn Tayler wrote:
| The subject line and attachment names are randomized, some what, by
| the bug, before sending. Also the pley to address is probably not
| any good, one or more characters are usually altered so the victim
| doesn't find out about the infect as quickly. Nasty business.
| Spent 4 hours doing battle with Magistra at a clients office
| yesterday. Got 5 machines before we stopped it. Fotunately, the
| nast payloads don't deploy quickly on that bug. Seems McAfees AV
| software isn't real good at catching the damned things while
| downloading. It only caught it after the requisite 20 files, 21
| with the original file, was attempted to be accessed on the reboot,
| sets itself up in Win.ini with a run command. Didn't save one for
| the zoo, so I'm looking for Sircam if it shows up....
i'd be happy to send you one -- i saved a whole message as a file --
and havingf gotten a second round of 'em last night i've come to
conclude that the naming comes largely from whatever user file it
attaches to the worm itself before heading back out -- which is
another of its features, it shares users' files.
here's my response to those who send it to me:
From: dep <[EMAIL PROTECTED]>
To: [name i'm withholding]
i just received a windows macro virus from you, with the subject
"stikbikeboy." it probably has one of your private files attached to
it; i do not know and do not plan to dissect it to find out. but you
have probably also sent it to others in your windows addressbook as
well, or others whose email addresses somehow appear somewhere on
your computer.
please either change operating systems to something secure, undertake
to secure your windows machine, or disconnect your machine from the
internet.
thank you.
[eoq]
time has come for us to not let the internet be hijacked by people
running software from a company too lame to fix its own well-known
security exploits.
--
dep
one day, you'll wish it was now.
your wish has been granted.
don't waste it.
_______________________________________________
http://linux.nf -- [EMAIL PROTECTED]
Archives, Subscribe, Unsubscribe, Digest, Etc
->http://linux.nf/mailman/listinfo/linux-users
