Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Anyone heard of a virus or worm called "Sorry"?

0 views
Skip to first unread message

Chuck Hershiser

unread,
Mar 27, 2001, 10:08:04 PM3/27/01
to
I received an email from a friend the other day that had an attachment.
The subject line of the email and attachment was "I'm sorry about
yesterday". When I tried to open the attachment, I got a warning from my
virus checker (InoculateIT PE)saying the attachment was a worm. I
clicked the OK on the warning and tried to delete the email, but it
wouldn't delete. I closed Netscape and scanned my harddrive. It checked
out OK, so I rebooted and reopened Netscape. I deleted the email and
emptied the trash in email.
So far, I have had no problems with my machine. I notified my friend
that his computer may be infected. I have searched the web and can find
no description of any worm or virus called "I'M sorry..."
Has anyone heard of this? Is there any thing else I should do to my
machine?
I am running Windows ME on a laptop, using InoculateIT PE as a virus
checker.
Thanks in advance,
Chuck

AvengerŠ

unread,
Mar 27, 2001, 10:36:41 PM3/27/01
to

Possibly VBS.Sorry (A,B,C or D variant). Try here
http://www.symantec.com/avcenter/cgi-bin/vnsf.cgi


*************************************
SPAM is a curse!
I HATE Spammers!
Thou shalt NOT SPAM!
Because I Shalt Report *ALL* Spammers
*************************************

Nick FitzGerald

unread,
Mar 28, 2001, 5:08:52 AM3/28/01
to
AvengerŠ <felin...@yahoo.com> wrote:

> Possibly VBS.Sorry (A,B,C or D variant). Try here
> http://www.symantec.com/avcenter/cgi-bin/vnsf.cgi

If all you had to go by was the name, that would not be a bad guess.

However, Chuck has made the silly error of creating a name for his
suspected virus. The real clue is not in Chuck's ild guess that
"Sorry" may be the name of his suspected virus, but in the fact
that he received Email with an attachment named "I'm sorry about
yesterday". In fact, I suspect he received more than one message
and is confusing/combining the Subject: lines.

"I_am_sorry.DOC.pif" and "Sorry_about_yesterday.DOC.pif" are two of
the names MTX uses for its attachments around the 23rd and 25th days
of the month.

I'd say that Chuuck was sent MTX and IPE saved him from infecting
his machine by preventing the code from running.


--
Nick FitzGerald

Giny

unread,
Mar 28, 2001, 1:22:13 PM3/28/01
to

> "I_am_sorry.DOC.pif" and "Sorry_about_yesterday.DOC.pif" are two of
> the names MTX uses for its attachments around the 23rd and 25th days
> of the month.
>

Yes, I had this awful, nasty virus, be VERY careful it is dirty and sticky.
I used the MTX-cleaner, then had to reinstall Windows 98 SE.

I was so stupid to open the attachment as I thought that McAfee would
protect me.
How could I know that by opening it I would be infected.
Am not much impressed anymore by antivirus software if it cannot protect
you...
Giny


Mark W. Brouwer

unread,
Mar 28, 2001, 4:21:49 PM3/28/01
to Giny

Viruses don't do any danger, ignorance does.

--
Mark W. Brouwer,
Netherlands.
Email not correct due to SPAM.
Please remove WODKA to reply.
-----------------------------------------
Home Page : Virus or Hoax ?
Got Infected? Want info? Search and find!
http://resource.at/virus
(framed/javascript enabled version)
-----------------------------------------
http://members.tripod.lycos.nl/brouw039/
(non-framed/javascript disabled version)
-----------------------------------------

br13n

unread,
Mar 28, 2001, 7:41:58 PM3/28/01
to
On Wed, 28 Mar 2001 23:21:49 +0200, "Mark W. Brouwer"
<mark.st...@wxs.nl> wrote:

>Viruses don't do any danger, ignorance does.

Is that Mark or Cicatrix speaking?

You don't by any chance live nearby that Mayor of Sneek?

Oops, sorry! I trust all's well... ;o)

Brien

Chuck Hershiser

unread,
Apr 2, 2001, 9:48:56 PM4/2/01
to
Thanks to you all for your answers. As my machine seems to be fine I'm
guessing that you are right Nick, IPE saved my bacon! I will send the
symantec site to my friend to check out.
Thanks again,
Chuck Hershiser

AkHibby

unread,
Apr 3, 2001, 10:39:57 AM4/3/01
to

"Giny" <g.spe...@GEENplanet.nl> wrote in message
news:99ta4o$4458v$1...@reader02.wxs.nl...
Some do, some don't, we have 65,000 clients running McAfee 4.5 SP1 which
allows several VBS scripts to execute even after IDing them by name on a
fair number of them. these include, LOVELTTR.AS, LOVELTTR.BE and
AnnaKournikova (SST). By default the scanner was set to clean, now changed
to delete.

NAI says that this flaw will not be fixed until their next version comes
out, I wonder if these 65,000 PCs will still have McAfee on them by then?

With my luck they'll switch to NAV :(

Ian


Traf...@jj2m.com

unread,
May 9, 2001, 10:56:07 PM5/9/01
to
In article <3ac2841...@news.paradise.net.nz>, br13n
God, we can't stop hearing it...

----- Posted via NewsOne.Net: Free (anonymous) Usenet News via the Web -----
http://newsone.net/ -- Free reading and anonymous posting to 60,000+ groups
NewsOne.Net prohibits users from posting spam. If this or other posts
made through NewsOne.Net violate posting guidelines, email ab...@newsone.net

Klaus

unread,
May 10, 2001, 1:13:14 AM5/10/01
to
On 10 May 2001 02:56:07 GMT, Trafton!@jj2m.com wrote:

<snip>

>God, we can't stop hearing it...

Sickening isn't it! Not unlike mass mailer malware getting repetitive
re-runs over and over again!

How about this deal then - I'll et al, will stop pissing off 4Q and
others like yourself, if the re-runs stop?

No, I didn't think so, oh well then... :o(

Klaus



Klaus

unread,
May 10, 2001, 1:32:54 AM5/10/01
to
On Thu, 10 May 2001 05:13:14 GMT, br13n...@hotmail.com (Klaus)
wrote:

>On 10 May 2001 02:56:07 GMT, Trafton!@jj2m.com wrote:
>
><snip>
>
>>God, we can't stop hearing it...
>
>Sickening isn't it! Not unlike mass mailer malware getting repetitive
>re-runs over and over again!

And further speaking in a sickly vein, I wonder if Hamilton and Sneek
are sister cities?

Klaus

0 new messages