Very sorry! Virus info....

[Rick Parent]

OPPS!!

Forgot to mention that if you have trouble deleting the "zero byte"
file, just rename it's extension ".vbs" to something else like ".001"
before you hit the delete button. And make sure you go to the
Recycle Bin and dump it from there (unless, of course, you were smart
enough to set your "Delete Option" to not use the Recycle Bin!). Good
Luck!

Rick Parent,  W0ZAP
rparent at sky.net


Gerry VanLoh wrote:
>
> Removal Instructions for AnnaKournikova.jpg.vbs :
>
>     1.Delete all found infections. If exists, delete the zero-byte file.
>        (search your drive C: for *.vbs)
>
>     2.Remove registry keys
>        (Use caution
>         START / RUN / REGEDIT and search for the key and remove it.)
>
> Registry keys:
>
>  HKCU/Software/OnTheFly/
>  HKCU/Software/OnTheFly/mailed
>
> It apparently mails itself out to everyone in your address book if you
> use MS Outlook/Express.
> It sets a date to go to a certain web site eventually... why?
> It will try to replicate itself on your system but due to a program bug,
> it fails.  You may find some vbs files with zero bytes.  Remove those
> having to do with the name of the attachment.)
>
> We've seen hundreds of these come through our email servers today and
> from reports, it's hitting a lot of systems now. Virus scanners aren't
> all up to date yet as this one is fairly new so far.
>
> Gerry WAØJCV
>
> Jim Roik wrote:
> >
> > What does this virus do? I had scanned it with Norton before opening it and
> > was told it was OK. I had trouble deleting it from my hard drive but was
> > finally able to do so. I have today's virus definitions from Norton and I am
> > told I am clean.
> >
> > But...???
> >
> > Jim
> >
> > If I have an attachment , do not open it.
> >
> > I just found out what it does. How do I get rid of it?
> >
> > > -----Original Message-----
> > > From: Heathkit Owners and Collectors List
> > > [mailto:HEATH at LISTSERV.TEMPE.GOV]On Behalf Of Dave
> > > Sent: Monday, February 12, 2001 2:23 PM
> > > To: HEATH at LISTSERV.TEMPE.GOV
> > > Subject: Very sorry! Virus info....
> > >
> > >
> > > Good Lord!  I have NEVER seen a virus rocket through
> > > the system like this thing!  I JUST did an update at Norton
> > > with my Virus checker (Norton 2001, fully paid version)
> > > RIGHT BEFORE opening my email program.  I have it set
> > > to scan all incoming emails.  It DID NOT see this virus.
> > >
> > > I have checked with Symantic and they are working on it, but
> > > DO NOT HAVE a scanner definition for this virus.
> > >
> > > So those of you who THINK you are scanning properly with
> > > Symantic products, you are NOT being scanned!!!  I just did
> > > it again, and it says I have no viruses.  So beware!
> > >
> > > Sorry my computer spouted more copies of this thing.
> > >
> > > Dave WB7AWK
> > >
> > > ----- Original Message -----
> > > From: "telmore" <telmore at TELMORE.COM>
> > > To: <HEATH at LISTSERV.TEMPE.GOV>
> > > Sent: Monday, February 12, 2001 12:09 PM
> > > Subject: Please Read
> > >
> > >
> > > > Please do not try and open an email from me with the attachment
> > > > AnnaKournikova.jpg.vbs it is a virus.
> > > >
> > > > Thank You
> > > > -Tom
> > > >
> > > > Listserver Subscription:listserv at listserv.tempe.gov - "subscribe heath
> > > 'name' 'call'"
> > > > Listserver Submissions: heath at listserv.tempe.gov
> > > > Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"
> > > >
> > >
> > > Listserver Subscription:listserv at listserv.tempe.gov - "subscribe
> > > heath 'name' 'call'"
> > > Listserver Submissions: heath at listserv.tempe.gov
> > > Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"
> >
> > Listserver Subscription:listserv at listserv.tempe.gov - "subscribe heath 'name' 'call'"
> > Listserver Submissions: heath at listserv.tempe.gov
> > Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"
>
> Listserver Subscription:listserv at listserv.tempe.gov - "subscribe heath 'name' 'call'"
> Listserver Submissions: heath at listserv.tempe.gov
> Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"

Listserver Subscription:listserv at listserv.tempe.gov - "subscribe heath 'name' 'call'"
Listserver Submissions: heath at listserv.tempe.gov
Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"