NANFA-- Virus on the list

Roselawn Museum (roselawn_at_mindspring.com)
Fri, 07 Dec 2001 11:09:32 -0500

Hi All

Earlier in the week, I picked up a virus from an attachment to a message on
the list. It took me all day yesterday to get rid of it. This is another
one of those critters that mails itself, so I doubt that I'm the only one
who got it. Check your machines, folks. Among other things, it blocked my
ability to download certain information, which kept my antivirus software
from automatically updating itself and detecting this new virus.
Fortunately, my ISP caught it and alerted me. I'm pasting in the body of
their message that contains remedy site info. As for the offending
attachment, watch out for the one that has HUMOR in the name. Once again,
some sad little jerks out there in cyberspace have WAAAAAY too much time on
their hands.

Steven A. Ellis
Kennesaw, GA

Earthlink offers a free virus scan in cooperation with Symantec's Norton
group. This free scan is only compatible with windows computers. The link
for that is:

http://www.earthlink.net/freescan/

Below are other places that you can find anti-virus software.

Symantec's website contains a description of the virus you seem to be
infected with at
http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b at mm.ht
ml .

The virus is known as W32.Badtrans.B_at_mm <>, and it
is known to do one or more of the following things:

1. It uses the email on an infected system (such as yours) to send copies
of itself to people you have emailed previously.

2. It adds an underscore mark at the beginning of the return address,
making it less likely that people will be able to reply to you and let you
know you have the virus. For example, if your email address were
theinternetrocks_at_earthlink.net <>, the
virus will email itself with a return address of
_theinternetrocks_at_earthlink.net <> .

3. It installs a 'trojan horse' program, which records each keystroke-
everything you type on your computer, and then sends that information to a
third party (by sending it to an IRC chat channel, a mailing list, etc.)
That third party would then have access to any sensitive information that
you typed while infected. Because of this, we STRONGLY recommend that you
change your EarthLink password once your system has been cleaned of the
virus, and that you consider doing so to any other sensitive information
that you have typed while infected.

It may also give the third party the ability to connect to your computer
directly, giving them access to your hard drive (all of the files on the
computer.)

At the following webpage you can find the proper steps on how to remove
most viruses from any computer:

http://www.symantec.com/avcenter/

Here are the addresses of some anti-virus companies; you
can check each out for more information.

http://www.symantec.com/
http://www.drsolomon.com/
http://www.mcafee.com/

You can find impartial reviews of many computer products at sites such as

http://www.cnet.com/
http://www.cnet.com/Content/Reviews/
http://www.zdnet.com/products/zones.html
http://www.zdnet.com/products/utilityuser/antivirus.html

/-----------------------------------------------------------------------------
/"Unless stated otherwise, comments made on this list do not necessarily
/ reflect the beliefs or goals of the North American Native Fishes
/ Association"
/ This is the discussion list of the North American Native Fishes Association
/ nanfa_at_aquaria.net. To subscribe, unsubscribe, or get help, send the word
/ subscribe, unsubscribe, or help in the body (not subject) of an email to
/ nanfa-request_at_aquaria.net. For a digest version, send the command to
/ nanfa-digest-request_at_aquaria.net instead.
/ For more information about NANFA, visit our web page, http://www.nanfa.org