Searching \ for '[PIC]: BEWARE VIRUS' in subject line. ()
Make payments with PayPal - it's fast, free and secure! Help us get a faster server
FAQ page: www.piclist.com/techref/microchip/devices.htm?key=pic
Search entire site for: 'BEWARE VIRUS'.

Exact match. Not showing close matches.
PICList Thread
'[PIC]: BEWARE VIRUS'
2000\12\28@020500 by Roman Black

flavicon
face
Dan Michaels wrote:
>
> Speaking of HA's, has anyone else been getting spam the
> last couple of days, with the subject title written in
> spanish, and an .EXE file attached?
>
> I don't know what this is, because I trash the email
> and erase the .EXE without looking.


BEWARE!!! This is a virus, or more accurately
trojan horse. DO NOT RUN the enano.exe file!!

I have been getting this sent to me every few
days for a couple of weeks now, the email address
is spam_OUTHahahaTakeThisOuTspamsexyfun.net, so I went to sexyfun.net
and they have a page there explaining that it is
not their fault, it is a FAKE email address, and
they tell you about the virus also called "snow
white" virus.

I thought it was someone I knew from the motorcycle
sites who had the virus (it auto emails everyone
they know) but if people here are gettting it it
must be coming from a piclist member. I have never
run the enano.exe file so I doubt it is me!! :o)
(I did get caught last year with happy99.exe
though).
-Roman

--
http://www.piclist.com hint: PICList Posts must start with ONE topic:
[PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads


2000\12\28@025544 by David VanHorn

flavicon
face
>
>BEWARE!!! This is a virus, or more accurately
>trojan horse. DO NOT RUN the enano.exe file!!

Well.. Why would you EVER run an exe emailed to you?
I never email anything in EXE format. (or .scr..)
Zip, or text files is all I send, and pretty much all I accept.

Eudora also isn't susceptable to most viruses that get Outlook.
--
Where's dave? http://www.findu.com/cgi-bin/find.cgi?kc6ete-9

--
http://www.piclist.com hint: PICList Posts must start with ONE topic:
[PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads


2000\12\30@143830 by Robert Francisco

flavicon
face
Lately, I have recieved an scr file. Out of curiosity I placed the file
where the other scr's are and it showed up as one of the choices as a screen
saver. I selected it and did a preview, nothing happened so I deleted the
scr file. Now, I'm thinking this is a bad thing as my system seems unstable.
I had a demo software that expired (time limited) during this time, could
this do it too?
I did a Norton AV and it came back clean but the def file is about a year
old.

TIA-Any help would be appreciated.

Robert


{Original Message removed}

2000\12\30@144904 by David VanHorn

flavicon
face
At 01:35 PM 12/30/00 -0600, Robert Francisco wrote:
>Lately, I have recieved an scr file.

"Snow white"?  Most unfortunate.. Virus.


--
Where's dave? http://www.findu.com/cgi-bin/find.cgi?kc6ete-9

--
http://www.piclist.com hint: The PICList is archived three different
ways.  See http://www.piclist.com/#archives for details.


2000\12\30@163808 by cjtech2000

picon face
I believe the 'Snow White' virus was a .exe, and it has been floating
around on this list.

However, a .scr file could have been a script which would run under
Windows Scripting Host.  If you placed in your \windows directory, and
tried to load it as a screen saver, I doubt it would have been executed
as a script file.

If you still have the file, or can retrieve it, you can open it up in
Notepad, and verify it's contents.

Good Luck,

Chris

On Sat, 30 Dec 2000, David VanHorn wrote:
{Quote hidden}

--
Earnest HemmingWay wrote: "The world is a fine place, and worth
fighting for" I agree with the second part.

--
http://www.piclist.com hint: The PICList is archived three different
ways.  See http://www.piclist.com/#archives for details.


2000\12\31@001219 by Roman Black

flavicon
face
Robert Francisco wrote:
>
> Lately, I have recieved an scr file. Out of curiosity I placed the file
> where the other scr's are and it showed up as one of the choices as a screen
> saver. I selected it and did a preview, nothing happened so I deleted the
> scr file. Now, I'm thinking this is a bad thing as my system seems unstable.
> I had a demo software that expired (time limited) during this time, could
> this do it too?
> I did a Norton AV and it came back clean but the def file is about a year
> old.
>
> TIA-Any help would be appreciated.
>
> Robert


Hi Robert. I had a "p0rno.scr" or something sent to me a few weeks
back, with a spanish language email. I examined the .scr file
in a hex editor and it had the MZ prefix typical of dos .exe
files. I deleted it, assuming it was a virus.

Since then I have had about 4 more emails, from a similar
sender address, but this time with "enano.exe" or something
as the attached file. Also a spanish language email and
the sending address www.se*yfun.net (*=x) Hahaha@

I went to se*yfun.net and they have a page explaining that
they are innocent victims, and telling more about this virus
sometimes called snow white. I believe that once the .scr
or .exe is run, a file is placed in your windows directory
or similar, and then when you email anyone it logs their
email address and sends them the virus later. It is not a
regular virus but is a trojan horse that may not be detected
by norton av.

More importantly, I noticed that Dan posted here he had the
same spanish virus sent to him, so it is becoming obvious
that someone on this piclist has this virus!! James help??
I have a record of the IP address of the last person who sent
it to me. Does that help?
-Roman

--
http://www.piclist.com#nomail Going offline? Don't AutoReply us!
email EraseMElistservspam_OUTspamTakeThisOuTmitvma.mit.edu with SET PICList DIGEST in the body


2000\12\31@062050 by Nigel Goodwin

flavicon
face
In message <000a01c07297$b4fd4820$660d53d1@robert>, Robert Francisco
<robertfspamspam_OUTMICROBALANCE.COM> writes
>Lately, I have recieved an scr file. Out of curiosity I placed the file
>where the other scr's are and it showed up as one of the choices as a screen
>saver. I selected it and did a preview, nothing happened so I deleted the
>scr file. Now, I'm thinking this is a bad thing as my system seems unstable.
>I had a demo software that expired (time limited) during this time, could
>this do it too?
>I did a Norton AV and it came back clean but the def file is about a year
>old.

I've recently received five SCR files, over the last couple of weeks -
Norton Anti-Virus identified all of them as a Virus and deleted them (it
was until to repair them). I use a fully updated version of Norton
Internet Security, which includes Norton Anti-Virus.

I placed one of them in quarantine, just out of interest, it contains
W95.Hybris.gen.dr, Norton reports the likelihood of seeing this virus as
'rare', and gives it's properties as 'memory resident', 'size stealth',
'full stealth', 'triggered event', 'encrypting', and 'polymorphic'.
--

Nigel.

       /--------------------------------------------------------------\
       | Nigel Goodwin   | Internet : @spam@nigelgKILLspamspamlpilsley.co.uk           |
       | Lower Pilsley   | Web Page : http://www.lpilsley.co.uk       |
       | Chesterfield    | Official site for Shin Ki and New Spirit   |
       | England         |                 Ju Jitsu                   |
       \--------------------------------------------------------------/

--
http://www.piclist.com#nomail Going offline? Don't AutoReply us!
email KILLspamlistservKILLspamspammitvma.mit.edu with SET PICList DIGEST in the body


2000\12\31@153720 by Dan Michaels

flavicon
face
Roman Black wrote:
........
>Since then I have had about 4 more emails, from a similar
>sender address, but this time with "enano.exe" or something
>as the attached file. Also a spanish language email and
>the sending address www.se*yfun.net (*=x) Hahaha@
>
.......
>More importantly, I noticed that Dan posted here he had the
>same spanish virus sent to him, so it is becoming obvious
>that someone on this piclist has this virus!! James help??


Si, muchacho Romano Negro. I received the same spanish-
language email 6+ times last week. Possibly the large #of
receipts is related to the number of piclisters who had
opened it. [else I need to stop bringing up controversial
subjects such as .....(items deleted).... on piclist].

- danM

--
http://www.piclist.com#nomail Going offline? Don't AutoReply us!
email RemoveMElistservTakeThisOuTspammitvma.mit.edu with SET PICList DIGEST in the body



'[PIC]: BEWARE VIRUS'
2001\01\02@141247 by Barry Gershenfeld
picon face
>More importantly, I noticed that Dan posted here he had the
>same spanish virus sent to him, so it is becoming obvious
>that someone on this piclist has this virus!! James help??
>-Roman

I think it is more correct to say that someone is getting our
addresses by reading the list, and sending us the viruses. They
are not actually coming through the list.

Barry

--
http://www.piclist.com hint: PICList Posts must start with ONE topic:
[PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads


2001\01\03@002842 by Roman Black

flavicon
face
Barry Gershenfeld wrote:
>
> >More importantly, I noticed that Dan posted here he had the
> >same spanish virus sent to him, so it is becoming obvious
> >that someone on this piclist has this virus!! James help??
> >-Roman
>
> I think it is more correct to say that someone is getting our
> addresses by reading the list, and sending us the viruses. They
> are not actually coming through the list.
>
> Barry

Would it be possible that it is a list member,
that has emailed some of us directly? Once the virus
is on your computer it regularly emails people
you have contacted.
-Roman

--
http://www.piclist.com hint: The list server can filter out subtopics
(like ads or off topics) for you. See http://www.piclist.com/#topics


2001\01\03@085345 by John Pfaff

flavicon
face
I've gotten two copies of snowwhite, both from hahaha@se*yfun.???, but one
was titled joke.exe and the other dwarf4you.exe

{Original Message removed}

2001\01\03@185100 by James Korman

flavicon
face
Roman Black wrote:
>
> Barry Gershenfeld wrote:
> >
> > >More importantly, I noticed that Dan posted here he had the
> > >same spanish virus sent to him, so it is becoming obvious
> > >that someone on this piclist has this virus!! James help??
> > >-Roman
> >
> > I think it is more correct to say that someone is getting our
> > addresses by reading the list, and sending us the viruses. They
> > are not actually coming through the list.
> >
> > Barry
>
> Would it be possible that it is a list member,
> that has emailed some of us directly? Once the virus
> is on your computer it regularly emails people
> you have contacted.
> -Roman
>
Doubt it. Before the other posts to PICLIST, I had been wondering where
the darn things had been coming from. Norton caught them, no problem.
I got about 4 or 5 before they stopped. All different senders!

Jim Korman

--
http://www.piclist.com hint: The list server can filter out subtopics
(like ads or off topics) for you. See http://www.piclist.com/#topics


More... (looser matching)
- Last day of these posts
- In 2001 , 2002 only
- Today
- New search...