W3C home > Mailing lists > Public > w3c-wai-ig@w3.org > October to December 2002

Virus Warning

From: Alan Cantor <acantor@interlog.com>
Date: Tue, 26 Nov 2002 23:21:21 -0500
To: <acantor@interlog.com>
Message-ID: <NDBBIFAOLLCHBBKFDBJJOECMDLAA.acantor@interlog.com>

I have just received an e-mail virus. The virus picked names from my address
book, and sent itself to 70 addresses. As I have about 300 names in my address
book, there is a chance that you received the virus.

HOW TO RECOGNIZE THE VIRUS

The virus is contained in an e-mail message. (Actually, I think it is a Trojan
Horse.)

The message is from me. The subject line of the infected message reads:

[Your name] you have received a greeting e-mailed by Alan Cantor.

The body of the message begins:

[Your name]
Alan Cantor has just mailed you a postcard.
Pick up your greeting card by clicking below:
http://www.Friend-Greeting.com/pickup.aspx?code=etc. etc.

WHAT TO DO IF YOU RECEIVED THE FRIEND GREETING CARD MESSAGE

The virus does not appear to do anything other than to reproduce; it does not
seem to do any damage. However, you will want to get rid of it by deleting the
e-mail message that bore it.

Do not click on the hypertext link (http://www.Friend-Greeting.com etc. etc.)
contained in the message!

Delete the Friend Greeting message. If you hold down the Shift key while you
press the Delete key, the message will be deleted permanently.

If you do click on the hypertext link, you will be prompted to install
software. Do not do install the software. It tries to load two new programs on
your system.

If you did install the software, go to the Control Panel, Add/Remove Programs.
Uninstall the two offending programs. One is called something like "Friend
Greeting." I don't recall the name of the second program, other that it was a
nonsense word. I think it was WINSRVC. Also be on the lookout for a program
called OTMS, which may be part of the same virus. Then delete the message as
described above.

Finally, run a full virus scan on your PC using up-to-date virus signatures.
My virus checker did not detect anything unusual after I uninstalled the
software and deleted the message.

Sorry about this. Fortunately, most of you will not have received the message
containing the virus.

Alan
Received on Tuesday, 26 November 2002 23:21:40 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 19 July 2011 18:14:07 GMT