wierd virus thing

adamx

Guest

• Oct 5, 2002

• #1

i received a message saying it was from someone on the yahoo/gsclubuk board, which my Norton AntiVirus picked up as having the new Bugbear worm in the attachment.
as i normally do if this kind of thing happens, i sent a courtesy email to the sender warning them that either they are being spoofed as the sender or that their system has a virus. my message was rejected by a third party called messagelabs.com as having a virus onboard. (which i'm pretty sure it hasn't; i am very careful and have done a full update and a full system scan yesterday evening) and then about 2 seconds later i received an advert from the same company selling me their software services.


did anyone else get the same message?
coincidence or a nasty way of spamming?

 

Paul G (BHT)

Creator

Mod Squad

Joined

Jan 30, 2001

Messages

21,070

Solutions

1

Reaction score

1,154

Location

Asgard

• Oct 5, 2002

• #2

Adam, sounds like it's the Bugbear worm doing it's rounds. I have received loads of them from people who's PC's have become infected.

W32.Bugbear@mm is a mass-mailing worm that is rapidly spreading to Windows users.

The subject and attachment name of incoming emails are randomly chosen. The attachment will have a double extension ending in .exe, .scr, or .pif. and the attachment is usually 50 or 69k big.

If any one thinks they have this virus Click Here to get the removal tool from Symantec

 

wessie

Registered user

Joined

Jan 8, 2002

Messages

13,131

Reaction score

467

Location

Welshpool

• Oct 5, 2002

• #3

I got 2 copies of bugbear from gsclub email addresses this morning

Spoofed to look like it came from the yahoo groups mailing list

As this mailing list strips attachments, the email must've came from a subscriber that has my Lineone email account in their address book

PC-Cillin finds the virus.
They have a fix at
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BUGBEAR.A
for those that have not upgraded their files recently.

Bugbear caused a major disruption to the email servers at several universities last weekend. Cardiff Uni IT dept. has been very busy this week, disinfecting PC's brought onto the site by freshers.

 

Steve

Registered user

Joined

Jan 7, 2002

Messages

6,661

Reaction score

1

Location

St. Ives, Cambridgeshire

• Oct 5, 2002

• #4

wessie said:

Spoofed to look like it came from the yahoo groups mailing list

Click to expand...

I can go one better than that. I had a couple supposedly from the Microsoft Outlook Welcome Team...

Steve

 

adamx

Guest

• Oct 5, 2002

• #5

following on...

evidently messagelabs are a bona fide company, and apparently their software is good stuff.

 

stewart

Guest

• Oct 6, 2002

• #6

Yes got the same as Adam today
Pain in the a--- really

Stewart

 

guitarman

Guest

• Oct 6, 2002

• #7

I got one a couple of days ago attached to a mail purporting to be a company offering a better web presence for the gsclubuk and I'm sure it came to me as I'd foolishly included my email address in a post (which Paul has now taken out) and a spider had scraped the board for @ signs.

I let Norton delete it for me.

Have any of you guys put an email address in a post as I've seen some "signatures" that include email addresses ?

 

snodog

Registered user

Joined

Oct 10, 2002

Messages

664

Reaction score

0

Location

east lothian

• Oct 23, 2002

• #8

messagelabs

Messagelabs are a genuine and I would guess reputable company - I'm basing this on the fact that the government department I work for, use them to filter all our external emails.