W3C home > Mailing lists > Public > w3c-wai-ig@w3.org > October to December 2002

Re: Virus Warning

From: Erik Hodge <ehodge@real.com>
Date: Tue, 26 Nov 2002 22:15:50 -0800
Message-Id: <>
To: "Alan Cantor" <acantor@interlog.com>, w3c-wai-ig@w3.org
It's worse than just a virus since it gets you to voluntarily
agree to allowing it to do the things it does.  Here are more

>When you begin to install, the first thing that pops up is what is known 
>as a "EULA" (End User License Agreement). It's quite long, and most folks 
>will not read it. They're counting on that. When you scroll to the bottom 
>of it and click "Accept," you have agreed to the terms of the EULA.
>Part of what you will have agreed to is to have monitoring/spyware 
>software installed on your computer which will periodically report a
>vast array of data back to the card company. The other part that you've 
>agreed to is to have the software send mail to EVERY SINGLE ADDRESS IN 
>In short, you've voluntarily agreed to install a virus-type product on 
>your machine. This is not a good thing.
>Since there is no virus in the email, and since you're voluntarily 
>agreeing to install the ActiveX component, VIRUS CHECKERS WILL NOT CATCH THIS.

At 23:21 11/26/2002 -0500, Alan Cantor wrote:

>I have just received an e-mail virus. The virus picked names from my address
>book, and sent itself to 70 addresses. As I have about 300 names in my address
>book, there is a chance that you received the virus.
>The virus is contained in an e-mail message. (Actually, I think it is a Trojan
>The message is from me. The subject line of the infected message reads:
>[Your name] you have received a greeting e-mailed by Alan Cantor.
>The body of the message begins:
>[Your name]
>Alan Cantor has just mailed you a postcard.
>Pick up your greeting card by clicking below:
>http://www.Friend-Greeting.com/pickup.aspx?code=etc. etc.
>The virus does not appear to do anything other than to reproduce; it does not
>seem to do any damage. However, you will want to get rid of it by deleting the
>e-mail message that bore it.
>Do not click on the hypertext link (http://www.Friend-Greeting.com etc. etc.)
>contained in the message!
>Delete the Friend Greeting message. If you hold down the Shift key while you
>press the Delete key, the message will be deleted permanently.
>If you do click on the hypertext link, you will be prompted to install
>software. Do not do install the software. It tries to load two new programs on
>your system.
>If you did install the software, go to the Control Panel, Add/Remove Programs.
>Uninstall the two offending programs. One is called something like "Friend
>Greeting." I don't recall the name of the second program, other that it was a
>nonsense word. I think it was WINSRVC. Also be on the lookout for a program
>called OTMS, which may be part of the same virus. Then delete the message as
>described above.
>Finally, run a full virus scan on your PC using up-to-date virus signatures.
>My virus checker did not detect anything unusual after I uninstalled the
>software and deleted the message.
>Sorry about this. Fortunately, most of you will not have received the message
>containing the virus.
Received on Wednesday, 27 November 2002 01:10:22 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 13 October 2015 16:21:21 UTC