[KCDXC] Fwd: NEW VIRUS WARNING: W32.Sobig.E@mm

Thu, 26 Jun 2003 21:23:45 -0500

The first anti virus rule is,  NEVER forward virus warning messages to
everyone you know.
The second is, don't respond to this message either.

73
Bob N0UF
----- Original Message ----- 
From: "Mike ZooLoo" <[email protected]>
To: "KCDXC" <[email protected]>; <[email protected]>; "nekar"
<[email protected]>; "DX Smack" <[email protected]>
Cc: "Moderators" <[email protected]>
Sent: Thursday, June 26, 2003 8:45 PM
Subject: [KCDXC] Fwd: NEW VIRUS WARNING: W32.Sobig.E@mm

> Subject: NEW VIRUS WARNING: W32.Sobig.E@mm
> Importance: High
>
>
> To All,
>
> A virus called Sobig is spreading across the Internet.
> It can arrive as an email with an attached file. The
> attached file could be named anything, but its name
> will end with the characters, ".zip." or ".zi" Sobig
> is able to lie about who sent it, so even an emailed
> .zip file that has a friend's or co-worker's name in
> the From: field could be the virus. Do not open any
> emailed .zip file until you have spoken to the person
> who allegedly sent it, and verified that the file
> contains data you need to conduct business.
> Automatically delete any email with an attached .zi
> file as this DOES contain the virus.
>
> The Subject line of the email will be one of the
> following:
>
> Re: Application
> Re: Movie
> Re: Movies
> Re: Submitted
> Re: ScRe:ensaver
> Re: Documents
> Re: Re: Application ref 003644
> Re: Re: Document
> Your application
> Application.pif
> Applications.pif
> movie.pif
> Screensaver.scr
> submited.pif
> new document.pif
> Re: document.pif
> 004448554.pif
> Referer.pif
>
> The attachment name will be one of the following:
>
> your_details.zip (contains details.pif)
> application.zip (contains application.pif)
> document.zip (contains document.pif)
> screensaver.zip (contains sky.world.scr)
> movie.zip (contains Movie.pif)
> Due to a flaw in the virus script the above
> attachments may come accross with just a ".zi"
> extension.  I you see this or any of the information
> above
> PERMANENTLY DELETE THE EMAIL.
> DO NOT TRY AND OPEN THE ATTACHMENT!  This is what runs
> the virus.
>
> NOTE:
> IF YOU DO NOT RUN THE ATTACHMENT THEN YOU DO NOT HAVE
> THE VIRUS!
> You must run the .pif or .scr attachments to activate
> the virus.
>
>
> The worm-deactivates on July 14, 2003, and therefore,
> the last day on which the worm will spread is July 13,
> 2003.
> Until then please be careful with your emails.
>
> The following are links to more detailed information
> on the virus:
>
> McAfee's Web page regarding this virus
>
> Symantec's Web page regarding this virus
>
> LiveSecurity Virus Alert on Sobig.b/Palyh
>
> LiveSecurity Virus Alert on Sobig.c
>
> MessageLabs speculation on Sobig's purpose
>
>
>
> __________________________________
> Do you Yahoo!?
> SBC Yahoo! DSL - Now only $29.95 per month!
> http://sbc.yahoo.com
> _______________________________________________
> Kansas City DX Club
> Does anyone read this stuff?
> KCDXC mailing list
> [email protected]
> http://mailman.qth.net/mailman/listinfo/kcdxc