Another note about this worm.
It places a copy of creative.exe in the startup folder of Windows so each
time you start your PC it sends the virus out to everyone in your address
book again. It also can create copies of itself named creative1.exe,
creative2.exe etc.
If you have Win95/Win98 (I don't know about Win2000) do a file find through
all your drives looking for creative?.exe. If you are on a network check the
network drives too. It searches for mapped drives as well.
-
Jack Davis
'69 2000
SRL311-11273
----- Original Message -----
From: <Fred_Katz@ci.sf.ca.us>
To: "Stan Wada" <swada@roundhse.com>
Cc: <Datsun-Roadsters@autox.team.net>
Sent: Friday, December 08, 2000 5:31 PM
Subject: Stans email worm
> I agree with Jason, thank goodness for the attachment stripper. Don't feel
> cheated that you didn't get the attachment, and please don't go looking
for
> it! Here's the info that we passed to our staff on the creative virus:
>
> ***
>
> Another worm virus is making its way around.
>
> The W32.Prolin.Worm uses Microsoft Outlook to email a copy of itself to
> everyone in your Outlook address book. It sends a copy of itself in a file
> with the following name:
>
> Creative.exe.
>
> It sends the file as an attachment in an email message with the following
> subject line:
>
> A great Shockwave flash movie
>
> The email consists of the following message:
>
> Check out this new flash movie that I downloaded just now ... It's Great
> Bye
>
> The worm then moves all .jpg and .zip files to the root folder. It renames
> each of these files and appends the following text to their extension:
>
> change atleast now to LINUX
>
> W32.Prolin.Worm is also known as the following: - Troj_Shockwave.A
> - Creative
> - Troj_Prolin.A
>
>
>
> ________________________ Reply Separator _________________________
> Subject: Re: A great Shockwave flash movie
> Author: ken ogi <ken@norstargroup.com>
> Date: 12/8/2000 4:03 PM
>
>
> nice virus - stan
> ken
>
>
> Stan Wada wrote:
>
> > Check out this new flash movie that I downloaded just now ... It's Great
> > Bye
> >
> > [demime 0.97c removed an attachment of type application/x-msdownload
which had
> a name of creative.exe]
|