Return-Path: <sentto-279987-4020-1007565450-fc=all.net@returns.groups.yahoo.com> Delivered-To: fc@all.net Received: from 204.181.12.215 [204.181.12.215] by localhost with POP3 (fetchmail-5.7.4) for fc@localhost (single-drop); Wed, 05 Dec 2001 07:18:09 -0800 (PST) Received: (qmail 20143 invoked by uid 510); 5 Dec 2001 15:17:53 -0000 Received: from n20.groups.yahoo.com (216.115.96.70) by all.net with SMTP; 5 Dec 2001 15:17:53 -0000 X-eGroups-Return: sentto-279987-4020-1007565450-fc=all.net@returns.groups.yahoo.com Received: from [216.115.97.189] by n20.groups.yahoo.com with NNFMP; 05 Dec 2001 15:12:40 -0000 X-Sender: fc@red.all.net X-Apparently-To: iwar@onelist.com Received: (EGP: mail-8_0_1_2); 5 Dec 2001 15:17:30 -0000 Received: (qmail 71442 invoked from network); 5 Dec 2001 15:17:28 -0000 Received: from unknown (216.115.97.172) by m3.grp.snv.yahoo.com with QMQP; 5 Dec 2001 15:17:28 -0000 Received: from unknown (HELO red.all.net) (12.232.125.69) by mta2.grp.snv.yahoo.com with SMTP; 5 Dec 2001 15:17:28 -0000 Received: (from fc@localhost) by red.all.net (8.11.2/8.11.2) id fB5FHUo01940 for iwar@onelist.com; Wed, 5 Dec 2001 07:17:30 -0800 Message-Id: <200112051517.fB5FHUo01940@red.all.net> To: iwar@onelist.com (Information Warfare Mailing List) Organization: I'm not allowed to say X-Mailer: don't even ask X-Mailer: ELM [version 2.5 PL3] From: Fred Cohen <fc@all.net> X-Yahoo-Profile: fcallnet Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Wed, 5 Dec 2001 07:17:30 -0800 (PST) Subject: [iwar] [fc:Mass.mailing.worm.on.march] Reply-To: iwar@yahoogroups.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Mass mailing worm on march By James Middleton, VNU Net, 12/4/2001 <a href="http://www.vnunet.com/News/1127318">http://www.vnunet.com/News/1127318> Antivirus experts have warned about a mass mailing worm which, while unremarkable is its design, is spreading rapidly across the UK. The 'Goner' virus is nothing special in its construction. It spreads via email, harvesting addresses from Outlook and chat program ICQ. Goner arrives as an email attachment purporting to be a screensaver under the name 'Gone.scr'. If the attachment is opened, a dialog box appears with a greeting, followed by an error message. This is simply a diversion, however. In the background the virus is doing its dirty work, mailing itself out to all names in the address books or using file transfer to spread through ICQ. Once it infects a machine, the worm searches for and terminates a number of processes including many that run firewalls or security software. The email version of the worm arrives with the subject line 'Hi' and contains the following text: "How are you ? When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it!" Antivirus firm F-Secure said the worm first appeared this afternoon [4 December]and is "spreading quickly throughout the UK". ------------------------ Yahoo! Groups Sponsor ---------------------~--> Stop Smoking Now Nicotrol will help http://us.click.yahoo.com/2vN8tD/_pSDAA/ySSFAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2001-12-31 21:00:00 PST