According to my antivirus software, I was just forwarded a virus as an
attachment to a NTDEV mailing with a subject similar to the above.
-Evan
Evan Hillman
Intelligraphics, Inc.
435-755-0309
Evan,
What antivirus software are you using? Ours did not catch it.
Bennet Levine
-----Original Message-----
From: Evan Hillman [mailto:xxxxx@pcu.net]
Sent: Friday, May 12, 2000 1:10 PM
To: NT Developers Interest List
Subject: [ntdev] “fwd - joke” - is a virus!
Importance: HighAccording to my antivirus software, I was just forwarded a virus as an
attachment to a NTDEV mailing with a subject similar to the above.-Evan
Evan Hillman
Intelligraphics, Inc.
435-755-0309
You are currently subscribed to ntdev as: xxxxx@ccontrol.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)
I believe it’s the ILOVEYOU vermin from last week.
-----Original Message-----
From: Bennet Levine [mailto:xxxxx@ccontrol.com]
Sent: Friday, May 12, 2000 11:20 AM
To: NT Developers Interest List
Subject: [ntdev] RE: “fwd - joke” - is a virus!
Evan,
What antivirus software are you using? Ours did not catch
it.
Bennet Levine
-----Original Message-----
> From: Evan Hillman [mailto:xxxxx@pcu.net]
> Sent: Friday, May 12, 2000 1:10 PM
> To: NT Developers Interest List
> Subject: [ntdev] “fwd - joke” - is a virus!
> Importance: High
>
>
> According to my antivirus software, I was just forwarded a
virus as an
> attachment to a NTDEV mailing with a subject similar to
the above.
>
> -Evan
>
>
> Evan Hillman
> Intelligraphics, Inc.
> 435-755-0309
>
>
> —
> You are currently subscribed to ntdev as:
xxxxx@ccontrol.com
> To unsubscribe send a blank email to
$subst(‘Email.Unsub’)
>
You are currently subscribed to ntdev as:
xxxxx@delphieng.com
To unsubscribe send a blank email to
$subst(‘Email.Unsub’)
We are using SOPHOS with MimeSweeper and it caught nicely. You do have to
download all the latest IDE files and keep up with the latest “identities”
though. This should be done daily. Anyone stupid enough to run an
unsolicited VBS file should of course consider an immediate career change to
one not involving computers. Unfortunately, this would be a very big group
of people… sad.
Regards,
Paul Bunn, UltraBac.com, 425-644-6000
Microsoft MVP - WindowsNT/2000
http://www.ultrabac.com
-----Original Message-----
From: Bennet Levine [mailto:xxxxx@ccontrol.com]
Sent: Friday, May 12, 2000 11:20 AM
To: NT Developers Interest List
Subject: [ntdev] RE: “fwd - joke” - is a virus!
Evan,
What antivirus software are you using? Ours did not catch it.
Bennet Levine
-----Original Message-----
From: Evan Hillman [mailto:xxxxx@pcu.net]
Sent: Friday, May 12, 2000 1:10 PM
To: NT Developers Interest List
Subject: [ntdev] “fwd - joke” - is a virus!
Importance: HighAccording to my antivirus software, I was just forwarded a virus as an
attachment to a NTDEV mailing with a subject similar to the above.
I have Norton 2000, running on Win98 SE, with the “email checking” enabled.
Saved my butt - I probably would have opened it - didn’t know there was a
“joke” variant, and I get sent lots of jokes…but if there was clearly
something that said VBS, I would have been suspicious at that point.
Trouble is, my family all uses AOL, and anything they forward comes as an
attachment. Pretty easy to get used to seeing attachments to almost
anything. Thank you, AOL, for the psychological conditioning…
-Evan
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Bennet Levine
Sent: Friday, May 12, 2000 12:20 PM
To: NT Developers Interest List
Subject: [ntdev] RE: “fwd - joke” - is a virus!Evan,
What antivirus software are you using? Ours did not catch it.Bennet Levine
> -----Original Message-----
> From: Evan Hillman [mailto:xxxxx@pcu.net]
> Sent: Friday, May 12, 2000 1:10 PM
> To: NT Developers Interest List
> Subject: [ntdev] “fwd - joke” - is a virus!
> Importance: High
>
>
> According to my antivirus software, I was just forwarded a virus as an
> attachment to a NTDEV mailing with a subject similar to the above.
>
> -Evan
>
>
> Evan Hillman
> Intelligraphics, Inc.
> 435-755-0309
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@ccontrol.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
You are currently subscribed to ntdev as: xxxxx@pcu.net
To unsubscribe send a blank email to $subst(‘Email.Unsub’)
I thank my IEEE membership and the personal email alias that they provide.
it has saved me several times in the last three years by deleting such
emails and notifying me.
----- Original Message -----
From: Evan Hillman
To: NT Developers Interest List
Sent: Friday, May 12, 2000 11:39 PM
Subject: [ntdev] RE: “fwd - joke” - is a virus!
> I have Norton 2000, running on Win98 SE, with the “email checking”
enabled.
> Saved my butt - I probably would have opened it - didn’t know there was a
> “joke” variant, and I get sent lots of jokes…but if there was clearly
> something that said VBS, I would have been suspicious at that point.
>
> Trouble is, my family all uses AOL, and anything they forward comes as an
> attachment. Pretty easy to get used to seeing attachments to almost
> anything. Thank you, AOL, for the psychological conditioning…
>
> -Evan
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Bennet Levine
> > Sent: Friday, May 12, 2000 12:20 PM
> > To: NT Developers Interest List
> > Subject: [ntdev] RE: “fwd - joke” - is a virus!
> >
> >
> > Evan,
> > What antivirus software are you using? Ours did not catch it.
> >
> > Bennet Levine
> >
> > > -----Original Message-----
> > > From: Evan Hillman [mailto:xxxxx@pcu.net]
> > > Sent: Friday, May 12, 2000 1:10 PM
> > > To: NT Developers Interest List
> > > Subject: [ntdev] “fwd - joke” - is a virus!
> > > Importance: High
> > >
> > >
> > > According to my antivirus software, I was just forwarded a virus as an
> > > attachment to a NTDEV mailing with a subject similar to the above.
> > >
> > > -Evan
> > >
> > >
> > > Evan Hillman
> > > Intelligraphics, Inc.
> > > 435-755-0309
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@ccontrol.com
> > > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> > >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@pcu.net
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@ieee.org
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
> though. This should be done daily. Anyone stupid enough to run an
unsolicited VBS file should of course consider an immediate career
change to one not involving computers.
:-)))) Even secretary girls (those of them who use computers) and even in
Russia know that attachments must not be launched.
rem barok -loveletter(vbe)
_>rem by: spyder / xxxxx@mail.com / @GRAMMERSoft Group /
Manila,Philippines
The virus author seems to be a bad pupil 
He misspelled “spider”.
Max_
Hey,
I would like to know more.
I’m also an IEEE member. How long did it take for them to fix the ILOVEU
virus? Did u receive any ILOVEU mails?
Does the alias effectively intercepts even the new viruses?
Mayank.
----- Original Message -----
From: Maverick
To: NT Developers Interest List
Sent: Saturday, May 13, 2000 4:41 PM
Subject: [ntdev] RE: “fwd - joke” - is a virus!
> I thank my IEEE membership and the personal email alias that they provide.
> it has saved me several times in the last three years by deleting such
> emails and notifying me.
> ----- Original Message -----
> From: Evan Hillman
> To: NT Developers Interest List
> Sent: Friday, May 12, 2000 11:39 PM
> Subject: [ntdev] RE: “fwd - joke” - is a virus!
>
>
> > I have Norton 2000, running on Win98 SE, with the “email checking”
> enabled.
> > Saved my butt - I probably would have opened it - didn’t know there was
a
> > “joke” variant, and I get sent lots of jokes…but if there was clearly
> > something that said VBS, I would have been suspicious at that point.
> >
> > Trouble is, my family all uses AOL, and anything they forward comes as
an
> > attachment. Pretty easy to get used to seeing attachments to almost
> > anything. Thank you, AOL, for the psychological conditioning…
> >
> > -Evan
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com]On Behalf Of Bennet Levine
> > > Sent: Friday, May 12, 2000 12:20 PM
> > > To: NT Developers Interest List
> > > Subject: [ntdev] RE: “fwd - joke” - is a virus!
> > >
> > >
> > > Evan,
> > > What antivirus software are you using? Ours did not catch it.
> > >
> > > Bennet Levine
> > >
> > > > -----Original Message-----
> > > > From: Evan Hillman [mailto:xxxxx@pcu.net]
> > > > Sent: Friday, May 12, 2000 1:10 PM
> > > > To: NT Developers Interest List
> > > > Subject: [ntdev] “fwd - joke” - is a virus!
> > > > Importance: High
> > > >
> > > >
> > > > According to my antivirus software, I was just forwarded a virus as
an
> > > > attachment to a NTDEV mailing with a subject similar to the above.
> > > >
> > > > -Evan
> > > >
> > > >
> > > > Evan Hillman
> > > > Intelligraphics, Inc.
> > > > 435-755-0309
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@ccontrol.com
> > > > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> > > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@pcu.net
> > > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> > >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@ieee.org
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@iguard.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
I received several copies and I never had a problem, because I never ran the
attachment. Perhaps as a rule people shouldn’t run attachments from people
they don’t know until M$ fixes these security holes.
For the life of me, I’d like to know what idiot at Microsoft thought that
VBS and email should mix. I have yet to see anyone use VBS attachments
for constructive purposes.
-------------------------±------------------------------------------------
Regards, | Texas Instruments Standard Linear & Logic
Joe Turner | Wire/Die Bond Group
Voice: 903 868-6182 | 6412 Hwy 75 South, M/S 812
fax: 903 868-6460 | Sherman, TX 75090-0084
> -----Original Message-----
> From: Mayank Kulshreshtha [mailto:xxxxx@iguard.com]
> Sent: Sunday, May 14, 2000 11:00 PM
> To: NT Developers Interest List
> Cc: xxxxx@ieee.org
> Subject: [ntdev] RE: “fwd - joke” - is a virus!
>
>
> Hey,
>
> I would like to know more.
>
> I’m also an IEEE member. How long did it take for them to fix
> the ILOVEU
> virus? Did u receive any ILOVEU mails?
> Does the alias effectively intercepts even the new viruses?
>
> Mayank.
>
> ----- Original Message -----
> From: Maverick
> To: NT Developers Interest List
> Sent: Saturday, May 13, 2000 4:41 PM
> Subject: [ntdev] RE: “fwd - joke” - is a virus!
>
>
> > I thank my IEEE membership and the personal email alias
> that they provide.
> > it has saved me several times in the last three years by
> deleting such
> > emails and notifying me.
> > ----- Original Message -----
> > From: Evan Hillman
> > To: NT Developers Interest List
> > Sent: Friday, May 12, 2000 11:39 PM
> > Subject: [ntdev] RE: “fwd - joke” - is a virus!
> >
> >
> > > I have Norton 2000, running on Win98 SE, with the “email checking”
> > enabled.
> > > Saved my butt - I probably would have opened it - didn’t
> know there was
> a
> > > “joke” variant, and I get sent lots of jokes…but if
> there was clearly
> > > something that said VBS, I would have been suspicious at
> that point.
> > >
> > > Trouble is, my family all uses AOL, and anything they
> forward comes as
> an
> > > attachment. Pretty easy to get used to seeing
> attachments to almost
> > > anything. Thank you, AOL, for the psychological conditioning…
> > >
> > > -Evan
> > >
This has become way off topic, but what the heck…
-
the problem is that these worms use your friends’ address books - so they
show up from people you do know as well as from people you don’t. E.g. your
mother gets an infected email from you along with all those cute pictures of
baby huey drooling milk vomit -
microsoft did not invent binary attachments. Mime encapsulates any image,
vbs included. Vbs attachments are no more or less insidious than any other
potentially executable attachment, its just that windows is the pervasive
desktop os (see DOJ etc.) so virus inventors of course target windows and
standard windows email apps (outlook) and use interpreted languages like vbs
to avoid any platform/release version issues.
I’d love to bash microsoft (yet again) but they did not cause this problem.
-----Original Message-----
From: Turner, Joe [mailto:Zeus@ti.com]
Sent: Monday, May 15, 2000 3:40 PM
To: NT Developers Interest List
Subject: [ntdev] RE: “fwd - joke” - is a virus!
I received several copies and I never had a problem, because I never ran the
attachment. Perhaps as a rule people shouldn’t run attachments from people
they don’t know until M$ fixes these security holes.
For the life of me, I’d like to know what idiot at Microsoft thought that
VBS and email should mix. I have yet to see anyone use VBS attachments
for constructive purposes.
-------------------------±------------------------------------------------
Regards, | Texas Instruments Standard Linear & Logic
Joe Turner | Wire/Die Bond Group
Voice: 903 868-6182 | 6412 Hwy 75 South, M/S 812
fax: 903 868-6460 | Sherman, TX 75090-0084
> -----Original Message-----
> From: Mayank Kulshreshtha [mailto:xxxxx@iguard.com
mailto:xxxxx]
> Sent: Sunday, May 14, 2000 11:00 PM
> To: NT Developers Interest List
> Cc: xxxxx@ieee.org
> Subject: [ntdev] RE: “fwd - joke” - is a virus!
>
>
> Hey,
>
> I would like to know more.
>
> I’m also an IEEE member. How long did it take for them to fix
> the ILOVEU
> virus? Did u receive any ILOVEU mails?
> Does the alias effectively intercepts even the new viruses?
>
> Mayank.
>
> ----- Original Message -----
> From: Maverick
> To: NT Developers Interest List
> Sent: Saturday, May 13, 2000 4:41 PM
> Subject: [ntdev] RE: “fwd - joke” - is a virus!
>
>
> > I thank my IEEE membership and the personal email alias
> that they provide.
> > it has saved me several times in the last three years by
> deleting such
> > emails and notifying me.
> > ----- Original Message -----
> > From: Evan Hillman
> > To: NT Developers Interest List
> > Sent: Friday, May 12, 2000 11:39 PM
> > Subject: [ntdev] RE: “fwd - joke” - is a virus!
> >
> >
> > > I have Norton 2000, running on Win98 SE, with the “email checking”
> > enabled.
> > > Saved my butt - I probably would have opened it - didn’t
> know there was
> a
> > > “joke” variant, and I get sent lots of jokes…but if
> there was clearly
> > > something that said VBS, I would have been suspicious at
> that point.
> > >
> > > Trouble is, my family all uses AOL, and anything they
> forward comes as
> an
> > > attachment. Pretty easy to get used to seeing
> attachments to almost
> > > anything. Thank you, AOL, for the psychological conditioning…
> > >
> > > -Evan
> > ></mailto:xxxxx>
RE: [ntdev] RE: “fwd - joke” - is a virus!>desktop os (see DOJ etc.) so
virus inventors of course target windows and
standard windows email apps (outlook) and use interpreted languages like
vbs to avoid any platform/release version issues.
If Linux would be the most popular OS - then there will be viruses not on
VBS,
but on bash or perl scripts. But they will be - for sure.
Max