virus?

Tranc

unread,

Jun 23, 2002, 4:38:31 PM6/23/02

to

Hi all,

I just got the following message 31 times in my inbox. Anyone heard of this
before? attached was a "screensaver" named fucker.scr. I didn't open it.

thanks,

erik

Hi
Check the Attachement ..
See u

Goos en Linda Boers

----- Original Message -----
From: "lovers" < fri...@truefriends.org >
To: < go...@planet.nl >
Sent: Sun,23 Jun 2002 21:10:09 PM
Subject: :-)

This e-mail is never sent unsolicited. If you need to unsubscribe,
follow the instructions at the bottom of the message.
***********************************************************

Enjoy this friendship Screen Saver and Check ur friends circle...

Send this screensaver from www.truefriends.org to everyone you
consider a FRIEND, even if it means sending it back to the person
who sent it to you. If it comes back to you, then you'll know you
have a circle of friends.

* To remove yourself from this mailing list, point your browser to:
http://truefriends.org/remove?freescreensaver
* Enter your email address (go...@planet.nl) in the field provided and
click "Unsubscribe".

OR...

* Reply to this message with the word "REMOVE" in the subject line.

This message was sent to address go...@planet.nl
X-PMG-Recipient: go...@planet.nl
<>>> <>>> <>>> <>>> <>>> <>>> <>>> <>>> <>>> <>>>

Art Kopp

unread,

Jun 23, 2002, 4:49:50 PM6/23/02

to

On Sun, 23 Jun 2002 20:38:31 GMT, "Tranc" <bill...@microsoft.com>
wrote:

And what exactly did your up to date av scanner(s) report when you
Saved and scanned the attachment?

Art
http://www.epix.net/~artnpeg
Reply to address should work.

Tranc

unread,

Jun 23, 2002, 4:57:41 PM6/23/02

to

> And what exactly did your up to date av scanner(s) report when you
> Saved and scanned the attachment?

Well, actually I didn't scan it with my up-to-date Norton virusscanner,
because of this: (not sure if this is right) If this is a brand new virus,
norton won't have it in his definitionfiles, and that way there`s a chance,
whatever large or small, that the virus won't be recognised.

Erik

Frederic Bonroy

unread,

Jun 23, 2002, 5:03:35 PM6/23/02

to

Tranc wrote:

> Well, actually I didn't scan it with my up-to-date Norton virusscanner,
> because of this: (not sure if this is right) If this is a brand new virus,
> norton won't have it in his definitionfiles, and that way there`s a chance,
> whatever large or small, that the virus won't be recognised.

Well, if Norton does not recognize it then you should feel free to
send it to avsu...@symantec.com so they can improve their product.

To actually receive a response, send it to submit...@avp.ch. :-)

But before you do that save it to disk and scan it. If you are afraid
of infecting yourself simply delete the message and don't worry about
it any longer.

Tranc

unread,

Jun 23, 2002, 5:02:55 PM6/23/02

to

> >I just got the following message 31 times in my inbox. Anyone heard of
this
> >before? attached was a "screensaver" named fucker.scr. I didn't open it.

Addition information: the subject line is not everytime the same. There are
about 5 different subjects. The same goes for the attachment. One of them is
Praktijkuitje08.mdb.bat .This one has the added extention .bat, something I
don't trust at all. The automatic virusscanner from hotmail (mcafee) didn't
find any virusses, but I still don't trust it.

Erik

Art Kopp

unread,

Jun 23, 2002, 6:17:34 PM6/23/02

to

On Sun, 23 Jun 2002 21:02:55 GMT, "Tranc" <bill...@microsoft.com>
wrote:

Since you seem so uncomfortable handling the attachments you had best
just delete them and the entire emails. It's unfortunate since if this
is something new, it's important that av vendors get samples.

stardust

unread,

Jun 24, 2002, 10:09:11 PM6/24/02

to

Tranc wrote on 23 Jun 2002:

> Hi all,
>
> I just got the following message 31 times in my inbox. Anyone heard of
> this before? attached was a "screensaver" named fucker.scr. I didn't
> open it.
>
> thanks,
>
> erik
>
> Hi
> Check the Attachement ..
> See u
>
> Goos en Linda Boers
>
> ----- Original Message -----
> From: "lovers" < fri...@truefriends.org >
> To: < go...@planet.nl >
> Sent: Sun,23 Jun 2002 21:10:09 PM
> Subject: :-)
>
>
> This e-mail is never sent unsolicited. If you need to
> unsubscribe, follow the instructions at the bottom of the
> message.
> ***********************************************************
>
> Enjoy this friendship Screen Saver and Check ur friends
> circle...
>

The virus is a new one called yaha.g.....here's a couple links with some
more info...

http://www.mcafee.com/anti-virus/viruses/yaha/?cid=3459
http://www.sophos.com/virusinfo/analyses/w32yahae.html

stardust

Tranc

unread,

Jun 25, 2002, 9:17:44 AM6/25/02

to

> The virus is a new one called yaha.g.....here's a couple links with some
> more info...
>
> http://www.mcafee.com/anti-virus/viruses/yaha/?cid=3459
> http://www.sophos.com/virusinfo/analyses/w32yahae.html

Thanx, just read the pages. Can't imagine some people are so stupid/childish
like the ones that created this virus.

Erik

SomeBlokeCalledRapunzelSyndrome

unread,

Jun 25, 2002, 9:44:02 AM6/25/02

to

Tranc wrote:
>
> Hi all,
>
> I just got the following message 31 times in my inbox. Anyone heard of this
> before? attached was a "screensaver" named fucker.scr. I didn't open it.

oh, come on: it arrives 31 times, with a swearword filename and a file
extension that's executable? Of course it's malware. This is a
no-brainer. Bin it.
--
I'm wearing sandals!

Tranc

unread,

Jun 27, 2002, 9:39:30 AM6/27/02

to

> oh, come on: it arrives 31 times, with a swearword filename and a file
> extension that's executable? Of course it's malware. This is a
> no-brainer. Bin it.
> --
> I'm wearing sandals!

I like to know what exactly is attacking me, and indeed, I was pretty sure
it was a virus