> David,
>
> Thanks for the warning (this appears to be a particularly nasty little
one) although I believe these aren't actually via the Forum, but they do
appear to be - I haven't received them, although I have received some
others, including one from Jabiru, and one that appeared to come via the
Europa factory.
>
> What the virus appears to do is pick two addresses from the user's emails
and/or address book and send the email to one, supposedly from the other.
That way there is a chance the recipient will trust the email and open the
attachment, given that the recipient knows the 'sender'. It will also get
past a lot of spam filters on that basis, too.
This is an old 'tried and tested, never failing method' that's been going
for quite a while now - never trust attachments. I remember about a year
ago, I had a serios virus attack which was taking about 80% of my time for a
few weeks - not nice... but educating my (at the time) 700 users reduced my
workload for virus problems to about 0.1%
> The instances I've had have both had attachments with an .scr attachment -
which is a screensaver file, basically a Windows executable. If anyone gets
an email with such an attachment, just delete the whole email.
One of the best one's I've seen is something like "nakedchick.jpg.
scr" - on some email readers, you won't see the " scr" bit and
think "cool, I'll check her out"... except it wasn't a jpg file, it was a
scr file - which is almost ab execuatble file (on M$ based machines).
> Full details are at
http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbear@mm.html
- I note that Symantec have just upgraded the severity based on the number
of occurrences.
>
> This is off-topic, I know, but I hope worthwhile given that Forum
contributors are all at risk of getting these email. I suspect
non-contributing 'lurkers' are safe, given that they can only be reached
through the Forum, and the software strips out attachments before
distributing posts.
Very wothth while - if all forum members get the worm, the forum may get
over loaded and we all know how fragile it is.
Cheers,
Mark.
________________________________
Mark Jackson - +44 (0)7050 645590
europa-builder@ntlworld.com
http://harley.pcl.ox.ac.uk/~mark/Europa
|