Re: [cobalt-users] Virus email

["Raymond K. Symons" <rksymons@xxxxxxxxxxxxx>]

> >Basically, it infects any Windows machine which executes it by copying
> >itself to a bunch of different system files, and patches WSOCK32.DLL to
> >allow itself to send itself via outgoing emails.
>
> Who on this list uses windows? Since this is a virus and not a

First of all, I am certain there a lot of people on this list who use
Windows, at home at least...

Most of these viruses are attaching themselves to email sent by a person
whose computer is infected, exactly as mentioned above, by modifying, or in
some cases, completely replacing winsock on the infected computer.

We have a customer who was infected with the WM95.MTX virus a couple weeks
ago.  That particular virus went so far as to block any attempts by the user
to go to Symantec or McAfee's web site to retrieve virus definition updates.

In order to clean her computer, we had to physically hook up her HDD to a
machine that had current virus definitions installed and scan it that way.
It found well over 100 infected files.

That virus was sending itself as attachments to email, mostly as screensaver
files (*.scr) or as MPEG files.  It did, however, still require that the
recipient actually opened the attachment.

In any case, it is the nature of these things to propagate themselves and
the thought that anyone on this list would do it intentionally is pretty
ludicrous.  If you want to understand a bit more about the nature of the
beast, feel free to educate yourself at:

http://www.symantec.com/avcenter/index.html

Until you really understand what it is you are dealing with, I think it
would be prudent to stop accusing list members of sending these things out
maliciously.  If you received a virus from a list member, how about just
letting them know that you got it from them (off list) so they can take
whatever action they need to to clean their computer(s).

rks