On Sat, Nov 25, 2000 at 02:42:29PM -0500, Abby Sale wrote:> Ah...
> 12 years on the 'net and my very first "Tell everyone you know."
>
> I got virused to day by a feller named bruce.
>
> I am not knowledgeable on this but I'll just give you the best I got.
>
> It came as 5 e-mails from Bruce ???crief?? and addressed to me and several
> others - each item differently. The subject line in each was the same as
> different executable e-mails I've received recently (FL_Ballot.exe, etc)
> Remarkably each had some 546 lines in the message.
>
> Since this looked odd but had friendly Subjects, I saved to disk instead of
> launching direct from my Reader. I ran MacAfee Viruscan with definitions
> file 4.0.4099 (Nov 12, 2000) (and full heuristics) which showed then clean. You should have immediately downloaded the latest definitions
file, and even then, it *might* be too new to be recognized. These
virus writers work fast to make new ones, unfortunately.> I manually launched one (FW_.exe, etc) & got zapped. A basic rule is that *any* executable should not be trusted
unless:1) You know the person who sent it to you.2) You *knew* that he was going to send it to you, or have
confirmed via phone conversation that he did send it to you, and
*why*.3) You know *what* it is supposed to do -- and you need to do
that. If you don't do all of this -- put it on a sacrificial computer
which has nothing important on it, and see whether it trashes *that*
machine -- don't trust it on your main system. It may well be that your computer sent off copies of this under
*your* name to people in *your* address list, while it was trashing the
rest of the system.> I use Win95-B and it put a command somewhere in my registry that almost any
> Windows program call _must_ be proceeded by using winsvrc.exe, which it
> can't find. A Windows-looking dialog asks its location. Of course it
> doesn't exist. I tried to fool it by creating an empty file _called_
> winsvrc.exe in the root directory but then the virus simply claims that
> _none_ of my programs are Windows 95 programs and cannot be run. The
> desktop opened more or less normally & Windows Explorer (which had been
> open) worked ok but I could not run any significant or system program. It may be expecting some kind of return from that winsvrc.exe
whenever it is run. I don't do Windows, so I don't know whether it is a
standard program which the trojan deleted, or something that it was
going to add to do more mischief every time you booted or tried to run
some other program.> I'm a good backer-upper and wished to restore User.dat, (user.da0 is also
> corrupted by this wiseguy), and System.dat and System.ini and Win.ini (just
> to be sure - I don't know I need them all) But back-up is a windows-based
> program and won't work.
>
> Finally, since I (cheerfully patting myself on the back with both hands and
> both feet) use Backup Version 6 from Win 3.95 (because it will _include_
> selected files, not just _exclude_ them) I was able to drop to DOS and
> restore the 4 files.
>
> I suffered no loss at all except about two hours of confusion. You probably need to find reports of this in some of the
anti-virus sites, to see whether it also adds other nasty programs
(perhaps named the same as a normal system program) which will bite you
later.> Strongly recommend:
> Look out for e-mail of 546 or so lines Look out for *any* executable attachment. Treat it like a
scorpion or a poisonous snake. (I'm fairly safe, because I don't run a
system which knows *how* to run a .exe file. :-)> Back up the 4 system files in such a way they can be restored in DOS
> eg Win 3.x Back-up or perhaps create a Safe folder (directory) &
> just copy them from \Windows to this.
> You'll need some DOS program that will deal with deleting, and
> copying files that are marked Read-only, System, and Hidden. (Norton
> Commander or FA.exe to change the characturists, eg.) Windows Explorer may
> work if you can get _it_ to work. While you're about it -- keep copies of the programs which you
use for restoring on floppies, in case what you have gets blown away.
And *don't* trust a folder which is on the system when the virus
strikes. It may search through for other copies to corrupt. It is a
*lot* safer having the backups on floppies or tapes. And -- when you
try to restore, to have the write-protection tab turned on, so the virus
can't trash your backups while you are trying to restore. I *hope* that you got it all -- but visit symantec's site, or
one of the others, to make *sure* about it. Good Luck,
DoN.--
Email: <[unmask]> | Voice (all times): (703) 938-4564
My Concertina web page: | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero --- |