RE Virus Alert: This is the latest information posted on McAfee's web site. http://vil.mcafee.com/dispVirus.asp?virus_k=99194&#characteristics If you wish to check for yourself go to http://www.mcafee.com/ and follow the Anti-Virus links Also McAfee's AVERT centers is at http://vil.nai.com/vil/virusSummary.asp?virus_k=99011 Additionally if you prefer McAfee's virus alerts are at: http://www.mcafeeb2b.com/avert/virus-alerts/default.asp Or you could try http://www.norton.com/ and poke about on their site. Bill Hodges This threat has gotten some unworthy attention due to a press release put out by another anti-virus vendor. AVERT considers this threat a low risk due to fact that its mailing abilities have been significantly crippled and that we have yet to receive a sample from the field. This is a mass-mailing worm and file encryptor. Due to the hard coded SMTP server address specified, the mailing routine does not currently work as intended (relaying has been disabled on the SMTP server). The only email addresses that the worm can successfully send to are those in the bezeqint.net domain. Therefore it is unlikely, at this time, that anyone outside of bezeqint.net will receive this threat. The worm is designed to arrive in an email with the following information: From: "Microsoft Support" <[email protected]> Subject: Invalid SSL Certificate Body: Hello, Microsoft Corporation announced that an invalid SSL certificate that web sites use is required to be installed on the user computer to use the https protocol. During the installation, the certificate causes a buffer overrun in Microsoft Internet Explorer and by that allows attackers to get access to your computer. The SSL protocol is used by many companies that require credit card or personal information so, there is a high possibility that you have this certificate installed. To avoid of being attacked by hackers, please download and install the attached patch. It is strongly recommended to install it because almost all users have this certificate installed without their knowledge. Have a nice day, Microsoft Corporation Attachment: sslpatch.exe Running the attachment causes the virus to attempt to extract all MAILTO: html tags found in .HT* files within the MY DOCUMENTS folder. It then tries to send itself to those addresses via SMTP. Finally, the virus encrypts all .EXE files in the current directory such that they are no longer executable. ----- Original Message ----- From: <[email protected]> To: <[email protected]> Sent: Monday, September 03, 2001 10:09 AM Subject: [HODGES-L] VIRUS ALERT!!! > PLEASE SEND THIS TO EVERYONE ON YOUR CONTACT LIST !!> >> > A new virus has > just been discovered that has been classified byMicrosoft> > as> > the most > destructive ever! This virus was discovered yesterdayafternoon> > by> >> > > McAfee and no vaccine has yet been developed. This virus simplydestroys> > > Sector Zero from the hard disk, where vital information for its> > functioning > > > are stored.> > This virus acts in the following manner: It sends itself > automaticallyto> > all> > contacts on your list with the title "A Virtual > Card for You."> > As soon as the supposed virtual card is opened, the > computer freezes so> > that> >> > the user has to reboot. When the > ctrl+alt+del keys or the reset button> > are> > pressed, the virus destroys > Sector Zero, thus permanently destroying the> > hard> > disk.> > Yesterday in > just a few hours this virus caused panic in New York,> > according> >> > to > news broadcast by CNN. This alert was received by an employee of> > > Microsoft itself. So don't open any mails with subject:> > "A Virtual Card > for You." As soon as you get the mail, delete it.> > Please pass this mail to > all of your friends. Forward this to everyonein> >> > your address book.> > > I would rather receive this 25 times than not at all. Also: Intel> > > announced> >> > that a new and very destructive virus was discovered recently. > > > If you receive an email called "An Internet Flower For You,"> > do not > open it. Delete it right away! This virus removes all dynamic> > link> > > libraries (.dll files) from your computer.> > Your computer will not be able > to boot up !!> > > > > > ==== HODGES Mailing List ==== > Faye Dyess [email protected] Listmanager > VOLUNTEER TO TRANSCRIBE CENSUS FOR THE USGENWEB PROJECT > http://www.usgenweb.org/census > Thou shalt read thine own message thrice before thou sendest it. > >