New worm

[Wayne G. O'Shea]

This is no hoax, personal experience this morning!!

If you get an email that has Special Financial Report as a subject and a
paperclip beside it do not click on it (and hopefully it is not your last
inbound email like mine was, where the cursor is automatically on top of
it!). It has an embedded worm. My firewall picked it up as it tried to make
it's embedded file AAFF.EXE the server, that was stopped but it was already
too late and it loaded itself in to my computer and crippled outlook express
and sent my printer into a conniption fit.

Luckily my son was just going out the door to return to University this
morning and it took him an hour to find and remove all the files and set up
a filter to catch this subject line while we wait for Symantec to create a
fix. You could watch the aaff file grow as it was assumable loading up my
address book for distribution.

We have captured and sent to Symantec for a fix.

Regards,
Wayne O'Shea





-----------------------------------------------------------------
List archives located at: https://mail.dcsol.com/login
username "rebel" password "builder"
Unsubscribe: rebel-builders-unsubscribe@dcsol.com
List administrator: mike.davis@dcsol.com
-----------------------------------------------------------------

[Wayne G. O'Shea]

Subject line was actually Special Investment Report, not financial. Do not
click on it until you have an updated virus protection document that covers
the aaff.exe and aac files that it contains. It is still not available
anywhere that I know of.

Wayne

----- Original Message -----
From: "Wayne G. O'Shea" <oifa@irishfield.on.ca>
To: <national@raa.ca>; "Murphy Rebel Builders List"
<murphy-rebel@dcsol.com>; <kpsutka@copanational.org>; "Adam Hunt"
<ahunt@copanational.org>; "Michel Hell COPA" <mhell@copanational.org>;
"Cathy Stanfield, COPA" <cstanfield@copanational.org>
Cc: <wings@csolve.net>; "JE Smith" <jesmith@sympatico.ca>; "John Spick"
<jrs@csolve.net>; "Wendy" <osheaw@squared.com>; "sally ayotte"
<sallyayotte@hotmail.com>; "Rich and Jay Thistle" <thistle@richthistle.com>;
"Myia Personal" <chipmunk@ldiindustries.com>; "CVDH"
<cvdh@ldiindustries.com>
Sent: Monday, September 30, 2002 9:44 AM
Subject: New worm

This is no hoax, personal experience this morning!!

If you get an email that has Special Financial Report as a subject and a
paperclip beside it do not click on it (and hopefully it is not your last
inbound email like mine was, where the cursor is automatically on top of
it!). It has an embedded worm. My firewall picked it up as it tried to

make

it's embedded file AAFF.EXE the server, that was stopped but it was

already

too late and it loaded itself in to my computer and crippled outlook

express

and sent my printer into a conniption fit.

Luckily my son was just going out the door to return to University this
morning and it took him an hour to find and remove all the files and set

up

a filter to catch this subject line while we wait for Symantec to create a
fix. You could watch the aaff file grow as it was assumable loading up my
address book for distribution.

We have captured and sent to Symantec for a fix.

Regards,
Wayne O'Shea

-----------------------------------------------------------------
List archives located at: https://mail.dcsol.com/login
username "rebel" password "builder"
Unsubscribe: rebel-builders-unsubscribe@dcsol.com
List administrator: mike.davis@dcsol.com
-----------------------------------------------------------------

[Bob Patterson]

Or you can stop worrying about that junk by running Linux !! :-)

No viruses anywhere NEAR that nasty - in fact, only TWO
documented examples I know of ...

Of course, you can also avoid most of the problems by staying
away from later WinDoze releases - Win 3.11 seems relatively safe !! ;-)

....bobp

---------------------------------orig.--------------------------------
At 10:36 AM 9/30/02 -0400, you wrote:

Subject line was actually Special Investment Report, not financial. Do not
click on it until you have an updated virus protection document that covers
the aaff.exe and aac files that it contains. It is still not available
anywhere that I know of.

Wayne

----- Original Message -----
From: "Wayne G. O'Shea" <oifa@irishfield.on.ca>
To: <national@raa.ca>; "Murphy Rebel Builders List"
<murphy-rebel@dcsol.com>; <kpsutka@copanational.org>; "Adam Hunt"
<ahunt@copanational.org>; "Michel Hell COPA" <mhell@copanational.org>;
"Cathy Stanfield, COPA" <cstanfield@copanational.org>
Cc: <wings@csolve.net>; "JE Smith" <jesmith@sympatico.ca>; "John Spick"
<jrs@csolve.net>; "Wendy" <osheaw@squared.com>; "sally ayotte"
<sallyayotte@hotmail.com>; "Rich and Jay Thistle" <thistle@richthistle.com>;
"Myia Personal" <chipmunk@ldiindustries.com>; "CVDH"
<cvdh@ldiindustries.com>
Sent: Monday, September 30, 2002 9:44 AM
Subject: New worm

This is no hoax, personal experience this morning!!

If you get an email that has Special Financial Report as a subject and a
paperclip beside it do not click on it (and hopefully it is not your last
inbound email like mine was, where the cursor is automatically on top of
it!). It has an embedded worm. My firewall picked it up as it tried to

make

it's embedded file AAFF.EXE the server, that was stopped but it was

already

too late and it loaded itself in to my computer and crippled outlook

express

and sent my printer into a conniption fit.

Luckily my son was just going out the door to return to University this
morning and it took him an hour to find and remove all the files and set

up

a filter to catch this subject line while we wait for Symantec to create a
fix. You could watch the aaff file grow as it was assumable loading up my
address book for distribution.

We have captured and sent to Symantec for a fix.

Regards,
Wayne O'Shea

*-------------------------------------------------------------------------*
To unsubscribe go to http://www.dcsol.com:81/public/listserv.htm
Archives located at http://rebel:builder@www.dcsol.com:81/default.htm
To contact the list admin, e-mail mike.davis@dcsol.com
*-------------------------------------------------------------------------*

-----------------------------------------------------------------
List archives located at: https://mail.dcsol.com/login
username "rebel" password "builder"
Unsubscribe: rebel-builders-unsubscribe@dcsol.com
List administrator: mike.davis@dcsol.com
-----------------------------------------------------------------