As GSF postmaster my Inbox this morning contained over 120 emails infected with the NOVARG.AA@MM virus.Luckily my AV definitions were up to date and they got quarantined immediately.
W32.Novarg.A@mm is a mass-mailing worm. The worm will arrive as an attachment with a file extension of .bat, .cmd, .exe, .pif, .scr, or .zip.
The Message headers will be either "Test" or "Hi". This nasty virus attempts to send random emails to email addresses in Outlook/Outlook Express and the messages will appear to have been sent by someone else.
For example I had a load from GSFcarparts email addresses that have never existed but were actually being mailed out by people as far away as Russia, Japan and Germany.[:(!]
Be on your guard. Update your anti virus definitions! Immediately delete and do not open new emails with attachemnts as above and headed "Hi", "Test" etc etc.
More details on this nasty from Symantec http://www.symantec.com
Good plain english explaintion at http://news.bbc.co.uk/1/hi/technology/3432639.stm
Virus Warning!!!
-
James.UK
- Posts: 1169
- Joined: 14 Dec 2003, 23:12
- x 2
Go to and run.. http://housecall.trendmicro.com/ its a free anti virus site, you need to download a small prog from them and then they scan your PC. [^]
If it brings up a list (my bro found 31 !!) double click on the first one.. it opens a new page giving removal info.. Copy paste the removal info to your desk-top.. continue untill you have all the info for each prob found.. then. disconnect from the site and one by one follow the instructions for removal..
Can be a long and trying job but better than having to re-format !! And DON'T try backing up if you have a virus onboard. all you will do is put the virus back when you reinstall the back up.. [:0]
If you run XP it is a good idea to turn your "System restore" OFF and clear all saved files untill you have cleaned your PC.. you don't want to reinstall the virus that way either!! When your PC is clear you can make a new "restore" point and all should be fine.. [:)]
AVG sadly doesn't find many viruses, in fact I dont think ANY anti virus prog finds more than about %50 of infections.. I ran 5 diff anti-virus progs on my PC.. 3 found nothing.. one found two..one found 5.. [V] I ended up having to throw my hardrive away as it was completely corrupt. I was unable even to run "F disk" or reformat.. [:I] [:(!]
I bought a new drive and things all seem fine now... [^]
Finally add-- [email protected] to all your address books. (A) this will prevent a virus from running any further down your addy list as it will be returned as undeliverable.. (B) when it comes back to you, you will know you have a virus!! you can then do something about it... [:I] [:)]
If it brings up a list (my bro found 31 !!) double click on the first one.. it opens a new page giving removal info.. Copy paste the removal info to your desk-top.. continue untill you have all the info for each prob found.. then. disconnect from the site and one by one follow the instructions for removal..
Can be a long and trying job but better than having to re-format !! And DON'T try backing up if you have a virus onboard. all you will do is put the virus back when you reinstall the back up.. [:0]
If you run XP it is a good idea to turn your "System restore" OFF and clear all saved files untill you have cleaned your PC.. you don't want to reinstall the virus that way either!! When your PC is clear you can make a new "restore" point and all should be fine.. [:)]
AVG sadly doesn't find many viruses, in fact I dont think ANY anti virus prog finds more than about %50 of infections.. I ran 5 diff anti-virus progs on my PC.. 3 found nothing.. one found two..one found 5.. [V] I ended up having to throw my hardrive away as it was completely corrupt. I was unable even to run "F disk" or reformat.. [:I] [:(!]
I bought a new drive and things all seem fine now... [^]
Finally add-- [email protected] to all your address books. (A) this will prevent a virus from running any further down your addy list as it will be returned as undeliverable.. (B) when it comes back to you, you will know you have a virus!! you can then do something about it... [:I] [:)]
-
AndersDK
- Posts: 6060
- Joined: 21 Feb 2003, 04:56
- x 1
James -
Working in IT myself - I'm impressed [:I]
- smart little gadget to add a bouncing mail address first off in alphabetic list of your adress book - I like that [8D][8D]
[email protected]
Working in IT myself - I'm impressed [:I]
- smart little gadget to add a bouncing mail address first off in alphabetic list of your adress book - I like that [8D][8D]
[email protected]
-
lhm_leak
- Posts: 135
- Joined: 21 Sep 2003, 02:33
People seem to be missing the point with these worms. If you don't open/run the attachment you won't get infected. Simple really.
If I get an attachment that I'm not specifically expecting, it gets binned straight away - no messing about, if it IS genuine it can always be resent.
Mind you, client programs like Outlook Excuse have a lot to answer for in that department - by default it (used to, don't know about now but judging from the fuss this worm's caused probably still does) opens attachments automatically, so you're screwed immediately. If you're worried, get a copy of Eudora or something similar and set it up properly - yes, you can still get infected, but you'll have to try (or be terminally stupid). These mail worms CAN BE AVOIDED COMPLETELY with the application of just a teeny bit of intelligence!!!
Stu.
If I get an attachment that I'm not specifically expecting, it gets binned straight away - no messing about, if it IS genuine it can always be resent.
Mind you, client programs like Outlook Excuse have a lot to answer for in that department - by default it (used to, don't know about now but judging from the fuss this worm's caused probably still does) opens attachments automatically, so you're screwed immediately. If you're worried, get a copy of Eudora or something similar and set it up properly - yes, you can still get infected, but you'll have to try (or be terminally stupid). These mail worms CAN BE AVOIDED COMPLETELY with the application of just a teeny bit of intelligence!!!
Stu.
-
Dave Bamber
- Posts: 627
- Joined: 25 Feb 2001, 02:17
- x 2
-
Jon
Fair enough, but you'd be amazed at the amount of "sensible" people that I work with that try to open these attachments as maybe they think its a picture of something. Despite I.T. sending round an "electronic communications policy" to everyone with email/intrnet access, and getting them to read and sign it. Our client PC's at GSF are "protected" by AVG professional, but despite all the PC's being set to auto update the virus definitions from AVG they were a couple of days behind. I actually use Norton 2003 at work which is very good in that it flashes a warning message "Virus found in this email" as it drops into the inbox and then quarantines it.
Anyway, as we take these things seriously, and as some of you know I'm now running both gsfcarparts.com and Andyspares Forum on a dedicated server I today splashed out on an Avast AV subscription to link into the Mailmax email service on the webserver, this will ensure that any viruses for any of the domains on this server are kicked into touch there and then before they even reach the client PC's at GSF.
Here at home I do admit to using AVG free edition and Sygate pers firewall, and update the definitions every 3/4 days.
Grateful to James.UK for his link to http://housecall.trendmicro.com and am pleased to report that no viruses found on this PC
)
Anyway, as we take these things seriously, and as some of you know I'm now running both gsfcarparts.com and Andyspares Forum on a dedicated server I today splashed out on an Avast AV subscription to link into the Mailmax email service on the webserver, this will ensure that any viruses for any of the domains on this server are kicked into touch there and then before they even reach the client PC's at GSF.
Here at home I do admit to using AVG free edition and Sygate pers firewall, and update the definitions every 3/4 days.
Grateful to James.UK for his link to http://housecall.trendmicro.com and am pleased to report that no viruses found on this PC
)-
James.UK
- Posts: 1169
- Joined: 14 Dec 2003, 23:12
- x 2
Hi Stu, unfortunately I don't think that's true. I NEVER open attachments, not EVER without confirming its contents either by knowing beforehand what it contains, or by email/phoning sender to ask what it is.. [:)]
I think virus progs get into your PC in other ways.. One.. by being hidden in MP3 music files.. Two... by being hidden in downloadable games.. Three.. By being hidden in "free" downloadable software stuff. Image manipulators, website builders, etc etc.
My friend next door has a PC with no internet connection whatsoever.. I found 5 viruses in his PC?? I think he got them from music CD's copied and given to him by other people.. They in turn had downloaded these MP3's or wave files from the internet? He certainly could NOT have got them via any email...
In the process of trying to eliminate a Trojan virus called PYSME_B I learnt a great deal**, for example it somehow remained in my PC after I cleared it?? All 5 anti virus scans came up clear!! But it came back every time I re-booted.. Soooo, I used a WIN98se boot disk to allow me to attack it via dos commands rather than via XP systems.. Result? it corrupted the boot disk!! lol... [:I] and its "pal" a Trojan called "WINdows_A" was busy "hijacking" my commands, resulting in my deleting the wrong files several times.. The worst thing it did was to rename my D:\ to C:\(D). when I tried to reformat my C:\ resulting in my reformatting the wrong drive!! You have to admire the lil buggers, some of these progs are real cute!!
**Other things I discovered.:- Grisoft AVG contains a phone-home exe.. hmmm.. MSN messenger tries to contact a website every time I go online, but its NOT on any start up menu, and is supposed to be in a "turned off" status.. hmmm.. XP pro contains several "spyware" progs on its install CD, they get auto installed when you load the prog.. "ADD-Aware" will remove them for you. [;)]
So please don't think if you ignore email attachments your PC is safe.. I wish that were true, but sadly its NOT... Where would YOU hide a virus? NOT in an email attachment.. that's far too obvious.. So what other 'freebies' do people download a lot?? therein lies the answer I think..
I am still trying to figure out how the viruses got into my PC.. as yet I still don't know.. But I'm thinking very hard about it... lol..
I am by no means an expert on this stuff. I have only had a PC for 4 years.. But you learn fast when its that or a dead PC!! [;)]... And fortunately most PC progs are fairly logical, and that is a big help. [:)]
I hit on the AAAA@ idea when my son sent me a virus via email a couple of years ago.. He had just found out he had a virus by an email being returned because a friend had changed server and thus made the old email addy obsolete, the retuned email had an attachment he did not send???? [:0] Made me think and I came up with the AAAAA idea simply as an "advance warning system" really, then realised it also stopped more emails being sent, but that was an accidental bonus.. [:I]
I think virus progs get into your PC in other ways.. One.. by being hidden in MP3 music files.. Two... by being hidden in downloadable games.. Three.. By being hidden in "free" downloadable software stuff. Image manipulators, website builders, etc etc.
My friend next door has a PC with no internet connection whatsoever.. I found 5 viruses in his PC?? I think he got them from music CD's copied and given to him by other people.. They in turn had downloaded these MP3's or wave files from the internet? He certainly could NOT have got them via any email...
In the process of trying to eliminate a Trojan virus called PYSME_B I learnt a great deal**, for example it somehow remained in my PC after I cleared it?? All 5 anti virus scans came up clear!! But it came back every time I re-booted.. Soooo, I used a WIN98se boot disk to allow me to attack it via dos commands rather than via XP systems.. Result? it corrupted the boot disk!! lol... [:I] and its "pal" a Trojan called "WINdows_A" was busy "hijacking" my commands, resulting in my deleting the wrong files several times.. The worst thing it did was to rename my D:\ to C:\(D). when I tried to reformat my C:\ resulting in my reformatting the wrong drive!! You have to admire the lil buggers, some of these progs are real cute!!
**Other things I discovered.:- Grisoft AVG contains a phone-home exe.. hmmm.. MSN messenger tries to contact a website every time I go online, but its NOT on any start up menu, and is supposed to be in a "turned off" status.. hmmm.. XP pro contains several "spyware" progs on its install CD, they get auto installed when you load the prog.. "ADD-Aware" will remove them for you. [;)]
So please don't think if you ignore email attachments your PC is safe.. I wish that were true, but sadly its NOT... Where would YOU hide a virus? NOT in an email attachment.. that's far too obvious.. So what other 'freebies' do people download a lot?? therein lies the answer I think..
I am still trying to figure out how the viruses got into my PC.. as yet I still don't know.. But I'm thinking very hard about it... lol..
I am by no means an expert on this stuff. I have only had a PC for 4 years.. But you learn fast when its that or a dead PC!! [;)]... And fortunately most PC progs are fairly logical, and that is a big help. [:)]
I hit on the AAAA@ idea when my son sent me a virus via email a couple of years ago.. He had just found out he had a virus by an email being returned because a friend had changed server and thus made the old email addy obsolete, the retuned email had an attachment he did not send???? [:0] Made me think and I came up with the AAAAA idea simply as an "advance warning system" really, then realised it also stopped more emails being sent, but that was an accidental bonus.. [:I]
-
lhm_leak
- Posts: 135
- Joined: 21 Sep 2003, 02:33
As an ex IT Manager myself (now thankfully back to pure software engineering) I have come across viruses, trojans, worms and many other forms of "MalWare" both at work and at home. Jon, you've hit on the best solution really, protect the mail gateway and you won't get these worms. A word of warning though - don't just install it and assume it's working, TEST IT using Eicar (for those who don't know, it's a small (68/69 byte - I forget the exact number, and there are 2 versions) program that's universally recognised as a virus by all leading AV software. It's NOT a virus, though...). I got bitten by an Exchange/NAI interoperation problem that let it right through until a patch was applied.
James, maybe you don't open attachments, but you DO download executables and media. SCAN THEM *BEFORE* YOU RUN THEM - you know it makes sense. The same applies to files you load from floppy, CDROM or whatever. Yes, CDROMs have been known to be infected during the production process.
My little rant was about rogue email attachments, but here's another thought; remember the W32.Blaster worm? Really, really nasty piece of work that one - the only way to keep that sort of thing out of your system is a good firewall. So think about that, too.
Happy Computing!!!
Stu
James, maybe you don't open attachments, but you DO download executables and media. SCAN THEM *BEFORE* YOU RUN THEM - you know it makes sense. The same applies to files you load from floppy, CDROM or whatever. Yes, CDROMs have been known to be infected during the production process.
My little rant was about rogue email attachments, but here's another thought; remember the W32.Blaster worm? Really, really nasty piece of work that one - the only way to keep that sort of thing out of your system is a good firewall. So think about that, too.
Happy Computing!!!
Stu
-
shaunthesheep
- Posts: 364
- Joined: 16 Jul 2002, 14:42
yep, i got caught out by this one as well, afetr i realised that my pc was infected, good old firewall www.zonelabs.com, i visted www.housecall.trendmicro.com & www.pandasoftware.com/activescan as housecall told me that i had it, but couldent remove it, even after downloading the file, then visted panda software, did scan.....virus gone, never to be seen again.
dom
dom
-
lhm_leak
- Posts: 135
- Joined: 21 Sep 2003, 02:33
I got hit by it when I forgot to start ZoneAlarm. Just once. Was connected for, oh, three minutes. Broke the connection, started ZA, ZA reports "MSblast.exe" attempting to connect. Look it up at the ZA database - OOPS.
Took me about 10 minutes to remove it permanently using the Symantec tool, but it served as a salutory reminder of why I installed ZA in the first place.
In case you're wondering - I start ZA manually due to a start-up conflict with IIS 5.0, which I also need. So far I've just been too busy/lazy to sort out the service dependencies on startup.
Maybe I'll have to have a go at writing something nasty - something that behaves oddly, unlike anything else, and drains your bank account, but something that you just can't bear to remove from your system. Look out for the new virus W32.Xantia.[:D]
Stu.
Took me about 10 minutes to remove it permanently using the Symantec tool, but it served as a salutory reminder of why I installed ZA in the first place.
In case you're wondering - I start ZA manually due to a start-up conflict with IIS 5.0, which I also need. So far I've just been too busy/lazy to sort out the service dependencies on startup.
Maybe I'll have to have a go at writing something nasty - something that behaves oddly, unlike anything else, and drains your bank account, but something that you just can't bear to remove from your system. Look out for the new virus W32.Xantia.[:D]
Stu.
-
oilyspanner
- Posts: 1246
- Joined: 26 Oct 2003, 16:08
-
BonceChops
- Posts: 449
- Joined: 28 Sep 2003, 11:08
-
lhm_leak
- Posts: 135
- Joined: 21 Sep 2003, 02:33
Neil, Stewart might be talking about doing a low-level reformat of the drive. I've only ever had to do that once, to correct an interleave problem, and it took about 8 hours to do. It'll definitely work, though.
Otherwise, just use fdisk without any options. Delete any partitions that are there and then create a new one, paying attention to the exit/shutdown instructions. If that doesn't work then it's a low-level job.
Stu.
Otherwise, just use fdisk without any options. Delete any partitions that are there and then create a new one, paying attention to the exit/shutdown instructions. If that doesn't work then it's a low-level job.
Stu.
-
AndersDK
- Posts: 6060
- Joined: 21 Feb 2003, 04:56
- x 1
The majority of earlier PC mainboards had the low level formatting feature in the BIOS setup.
Any old steam machine would likely do the job from the setup menu.
Seems to be extinct on most mainbords these days - appearently to prevent disasters by fumbling around too much ....
Still - I love the BIOS error message :
Keyboard failure - press F1 to continue ....
Any old steam machine would likely do the job from the setup menu.
Seems to be extinct on most mainbords these days - appearently to prevent disasters by fumbling around too much ....
Still - I love the BIOS error message :
Keyboard failure - press F1 to continue ....
-
James.UK
- Posts: 1169
- Joined: 14 Dec 2003, 23:12
- x 2
Sorry Stuart, I binned the drive about two weeks ago. [:I]
When I installed XP on my new drive, a "friend" recommended using the 'new' format (cant recall its name) instead of FAT32.. hmm funny how all my 'friends are PC experts! lol.. the end result was my PC would not run properly, it kept coming up with faults, freezing, blue screen, taking forever to connect using AOL.. etc etc.. I gave up!! it was all beyond me.. I reformatted using FAT32 and all is working normally now. [:)]
To be honest, a lot of the time you are talking Chinese as far as I'm concerned, I can do lil jobs like adding drives, modems, I fitted my AVerTV card etc with no major disasters, I can manage to alter bios to boot from whatever drive I need, But that's about my limit.. as for all the other stuff, I simply don't understand much of it.. [:(]
On the subject of items "lost", I need a copy of the "old" media player. I think it was either 6 or 7. looked like a lil square box? (I downloaded 6.4 to a folder, but when i tried to install it, it said it wont run on XP?? but I had it working fine before my virus probs and new drive fitted) I find the new WIN media player 9. wont go 'full screen' on any video above about 1.5 meg on my PC and as I am recording old family VHS videos, for myself and others, the size can be erm HUGE!! lol.. But I really need a prog that (A) allows me to 'pause' when recording, (to cut out bits like someone's foot coz they put the cam down and din turn it off!! etc).. At the moment I have to stop. Then start recording again thus making two separate videos, and as yet, I have not been successful in 'joining' videos together.. Any help or advice would be much appreciated, but in erm simple terms please if thats possible..
TV card is.. AVerTV.DVB-T. Editing Software I am struggling with is IntervideoWinDVD 4.. And (Magix) "media manager silver".. but its very complicated and difficult to understand, I think it was written in some other language originally and the translation was a bit iffy, as it doesn't seem to make sense in places. And important bits of info seem to be missing.
Running Win XP Pro.. RAM 512. CPU 1300 .
C:\40 GIG.. D:\CD-ROM.. F:\20 GIG (seperate hard drives, no partitions used).
Running AVG and Sygate personal firewall..
I have no DVD player now, so am temporarily copying VHF videos to CD Rom in mpeg format (via saving to my F:\ first).. I can play them back ok but up till now no-one else can!! [:I] [:o)] hehe...
Hmmm this is getting well "off topic" so if you can help, please email me at [email protected] or maybe start a 'PC stuff' thread in the General discussion forum? Thanks.. [:)]
When I installed XP on my new drive, a "friend" recommended using the 'new' format (cant recall its name) instead of FAT32.. hmm funny how all my 'friends are PC experts! lol.. the end result was my PC would not run properly, it kept coming up with faults, freezing, blue screen, taking forever to connect using AOL.. etc etc.. I gave up!! it was all beyond me.. I reformatted using FAT32 and all is working normally now. [:)]
To be honest, a lot of the time you are talking Chinese as far as I'm concerned, I can do lil jobs like adding drives, modems, I fitted my AVerTV card etc with no major disasters, I can manage to alter bios to boot from whatever drive I need, But that's about my limit.. as for all the other stuff, I simply don't understand much of it.. [:(]
On the subject of items "lost", I need a copy of the "old" media player. I think it was either 6 or 7. looked like a lil square box? (I downloaded 6.4 to a folder, but when i tried to install it, it said it wont run on XP?? but I had it working fine before my virus probs and new drive fitted) I find the new WIN media player 9. wont go 'full screen' on any video above about 1.5 meg on my PC and as I am recording old family VHS videos, for myself and others, the size can be erm HUGE!! lol.. But I really need a prog that (A) allows me to 'pause' when recording, (to cut out bits like someone's foot coz they put the cam down and din turn it off!! etc).. At the moment I have to stop. Then start recording again thus making two separate videos, and as yet, I have not been successful in 'joining' videos together.. Any help or advice would be much appreciated, but in erm simple terms please if thats possible..
TV card is.. AVerTV.DVB-T. Editing Software I am struggling with is IntervideoWinDVD 4.. And (Magix) "media manager silver".. but its very complicated and difficult to understand, I think it was written in some other language originally and the translation was a bit iffy, as it doesn't seem to make sense in places. And important bits of info seem to be missing.
Running Win XP Pro.. RAM 512. CPU 1300 .
C:\40 GIG.. D:\CD-ROM.. F:\20 GIG (seperate hard drives, no partitions used).
Running AVG and Sygate personal firewall..
I have no DVD player now, so am temporarily copying VHF videos to CD Rom in mpeg format (via saving to my F:\ first).. I can play them back ok but up till now no-one else can!! [:I] [:o)] hehe...
Hmmm this is getting well "off topic" so if you can help, please email me at [email protected] or maybe start a 'PC stuff' thread in the General discussion forum? Thanks.. [:)]