Virus Warning - Please read!

Anne

Site Owner
Thread starter
Staff Member
Admin
Joined
Oct 23, 2000
Messages
40,207
Purraise
6,095
Location
On TCS
I have received several emails today that seem to contain a new version of the SirCam virus. The virus seems to copy the text of an email it finds, so the emails may look like they came from the forums mailer.

Infected emails contain an attached file (which is the virus). This file takes on the name of a random file from where it originates and adds .pif at the end. Do not open this attachment!. Just reading the email will do no harm, but clicking on the attached file and running it would unleash the virus!

Infected emails can be recognized by the attched file and a sentence at the end that says:
> Take a look to the attachment.

The email is not really from the forums mailer (as you will see by the sender field) but it can be very misleading.

Please, the SirCam virus is becoming a real internet plague. Do not open any attached files you receive by email, unless you are expecting this person to send you that specific file. Also, install a good anti virus!
 

aristocat

TCS Member
Adult Cat
Joined
Aug 17, 2001
Messages
180
Purraise
1
Location
Stockport England
Thank you for the warning Anne,I,ve actually had to stop Jenna's Email coming through,we have both been getting rude Emails.I always cheak Jenna's Email for her,and I,ve been deleting all our Emails that are rude.Hopefully as time goes, it will stop happening.

Jackie
 

cleo

TCS Member
Top Cat
Joined
May 20, 2001
Messages
1,227
Purraise
2
Location
Portland Oregon
Thanks for the warning Anne.
You know, I just don't understand the mentality of people who do these things, I mean...Why? What could they possibly have to gain from this? It just makes no sense to me at all.

(shrug)
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
Okay, I have this virus. I sent warnings out to everyone on my e-mail list, not to open anything from me until I get rid of it...so if any of you receive an e-mail from me somehow, do NOT open it!!

I wish I had taken the time to install the virus protection program that Ken sent me, but I hadn't done it yet. I have an anti-virus protection, but it didn't seem to stop this one.

How the heck do I get rid of it now????????????

I live 70 miles away from a town with computer technitions. Crap.
I can still connect to this site, but if I should disappear for awhile, it will be due to the virus. Hopefully I can get this taken care of somehow.
I am going to install the Norton Virus protection that Ken sent me this weekend.
This is horrible!!!!!!!
 

imagyne

TCS Member
Veteran
Joined
Apr 13, 2001
Messages
1,632
Purraise
1
Location
CT
Debby,

Tsk Tsk Tsk....

Install it ASAP, then let it do an live update. It will get new virus signatures (so it knows the new ones) and then do a check on EVERYTHING. It will take a while. If you need help, give me a shout.

Aristocat..


For rude emails, check the header of the offending email to find out where it came from. Then forward the email in it's entirety to admin@whatever domain it came from ie [email protected]

If it was remailed from that domain, they'll be able to track it further.

If you need some help, let me know


Ken
 
  • Thread Starter Thread Starter
  • #6

Anne

Site Owner
Thread starter
Staff Member
Admin
Joined
Oct 23, 2000
Messages
40,207
Purraise
6,095
Location
On TCS
Debby, as I received the infected emails from you with the forums mailler message I thought the virus might be related to the forums. Well, I'm happy to say it's not. After many messages on webmasters forums, I found out that this virus is called "BadTrans" and what it does it to reply to any email you receive even before you read the email. It uses the reply function with the whole original message and adds the infected attachment and a line that asks the users to look at the attached file. Anyone that runs that file by double clicking on it will get the virus and so on.

The virus is a few months old, so if you do what Ken suggested you should be fine. If you need more details, check out these pages:

http://www.symantec.com/avcenter/[email protected]

http://www.antivirus.com/vinfo/virus...ROJ_BADTRANS.A
 

threeleggedkat

TCS Member
Top Cat
Joined
Mar 9, 2001
Messages
1,239
Purraise
2
Location
St. Louis, MO
Ken; I hate to bother you, but i can't get my webtv supplier (MSN just took over last week) to respond to this question: Can I be effected by viruses like this one Anne and Debby spoke of, and if so; how do I guard against it? We can't download anything like virus protection software, etc. Do we just hope that the pre-programming that comes with our "little black box" thingy is already equipted with such? If anyone else on here, who uses Webtv, knows the answer to this (or where I can go to find the answer) please respond. . . .


Thanks, TLK
 

aristocat

TCS Member
Adult Cat
Joined
Aug 17, 2001
Messages
180
Purraise
1
Location
Stockport England
Thank you for your advice Ken,so far today there has'nt been any strange Emails.Debby I hope you get your computer sorted out!


Jackie
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
Okay....Ken....I am so confused and I really need your advice.

I am going to install your anti-virus program you sent me, but I can't do it while I am online, because my dang internet connection here is so slow, either that or it is my computer, although, I just bought this computer brand new last year, so it shouldn't be that slow...but everytime I try to install your anti virus scan and then go to the websites, I have problems...I think I tell it to do so many things at once it just shuts down, I suddenly have websites popping up all over the place, and it just keeps going until I shut down.
This has nothing to do with the virus, as I have had this happen before when I am trying to download a program and play online at the same time.


Anyhow...I can easily download it tomorrow, when I'm not online...but here is what I am confused about....

On Friday night I got online as I usually do...and had this e-mail pop up from my sister-in-law....with an attachment....I of course didn't think twice about it, so I clicked on it. My anti-virus program popped up, as it always does when an e-mail has an attachment, and asked if I was sure I wanted to open it,...and I clicked yes....
Then suddenly a box came up, from my anti-virus protection, and asked if I wanted to save the new changes to one of my files....this has never happened before...so I clicked, NO...reject the changes.

So, then when I went back and checked the written part of the e-mail from my sister-in-law....it was an old e-mail, that I had sent to HER...way back in December of 2000. So, right then I knew something was screwy. Upon further examination, I realized that I had about 10 e-mails from her, all with attachments that said...see attachment at the bottom, and all of them were very old e-mails that I had sent her back in December.
So then suddenly, a whole string of e-mails popped up, saying they were from ME...to myself, from the catsite!!! But all of them had attachments...which catsite notification e-mails never do. I deleted them all right away.

So then my e-mail suddenly started saying it was sending message 1 of whatever, and I wasn't sending ANYTHING!!!! It was so spooky!!
So then,I got an e-mail from a webmaster administrator or something, saying one of my sent e-mails had been blocked, that I had sent to so-and so, (although I HADN't!!) It said my e-mail was infected with the Badtrans virus.
So then Anne sent me an e-mail saying she had gotten 15 e-mails from me that were infected.
But I haven't had any more problems at all since that night...That was Friday, this is Sunday, and I have ran my virus scanner twice, and it says I have no virus....so do I or don't I?????????
Help!!
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
Oh, also, Ken, one of the reasons I hadn't downloaded the CD you sent me yet, was because one of my friends told me that if I couldn't register it, I wouldn't be able to update it, and so in a few months it would be useless....this is obviously not true, or you would have told me, but I guess I need to ask.



Also, I just want to say Thank you, Ken....you have been such a doll to help me out like this.
*hugs*
 

imagyne

TCS Member
Veteran
Joined
Apr 13, 2001
Messages
1,632
Purraise
1
Location
CT
OKay,

First off, DO NOT use your email until you get this fixed. I can't stress this enough.

Secondly, if your are running virus software other than the one I gave you, the reason it can't find anything wrong is PROBABLY because it doesn't have the virus signature for it, so it doesn't know it exists.

Thirdly, if you've tried to install the one I sent you and are having problems then remove the one you are currently using. Do that through the control panel, add/remove programs.

Once that is done, do not go online, install the software, just do a basic install, don't do a live update or a check yet. Once it is installed restart your computer, go online don't check email, or start your browser. You're AV software should be running a little icon down by your time in the lower right hand corner, click on it to open the control panel, then select live update. It will connect to Symantic and get the newest updates that you need. get all of them and let it do the rest. once complete with the download and the install, reboot your computer. then do a full scan of everything.

Don't forget to let it protect your email also when you install it.

Now I wrote this from memory and as Im getting old and the electrons are slowing down, there may be a couple points that won't be exactly like I said, but it's close enough that you'll know what to do....

So print this and use it, you should be fine.
If you have ANY probs let me know.
Happy virus slaying
Ken


I forgot.... The live update feature is available for one year, registered or not, then everyone has to pay for the service.
 

imagyne

TCS Member
Veteran
Joined
Apr 13, 2001
Messages
1,632
Purraise
1
Location
CT
I really don't know the answer to that since I lack experience with WebTV. But, after looking at the WebTV site, I guess they don't either.. just kidding, although there is no information about virii on there sight, I did find the customer service number that should be able to answer your question.


Toll-free customer support is available at 1-800-469-3288

Sorry I could be of more help..


Ken

Oh, when you find out, could you let me know? Thx
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
Ken...THANK YOU!!!!!!!!

I don't have a printer to print this out, but if I just save it to my documents, I should be able to see it without going online. I hope.

I will do this tomorrow...so how much will it cost me after the first year to update it? and do they send me a notice? Do I just use my credit card to do it, then?

Sorry for all the questions!!!
So if this virus scan finds that I have this badtrans virus, will it get rid of it for me, or what?
 

threeleggedkat

TCS Member
Top Cat
Joined
Mar 9, 2001
Messages
1,239
Purraise
2
Location
St. Louis, MO
Ken; I called the 800# (thank you for providing it). They assured me that the "Black Box Thingy" IS equipted with anti-virus software and that they update it continually. They also said that a lost e-mail or a mis-directed url occasionally is to be expected. Yeah, like what else WOULD they say!

I still am not happy with the service since MSN took over. I never had this many disconnects or technical difficlties pop-ups before the take over.
 

imagyne

TCS Member
Veteran
Joined
Apr 13, 2001
Messages
1,632
Purraise
1
Location
CT
TLK..

"Aint Microsoft great"


The only company I know of that gets the public to actually pay to beta test for them....

No wonder Bill has all the money.

Ken
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
Ken....I downloaded the disk you sent me.
Then I updated it.
It found four infected files....3 of which were infected with the w32.badtrans.13312@mm virus, and 1 that was infected with something called the backdoor trojan virus......(man that sounds vile!!!)
I told the system to repair them...but it said it couldn't. It couldn't delete them either, all it could do was quarantine them...whatever that means....so....how the heck do I get RID of these things???? HELP!!!!!!!!
 

imagyne

TCS Member
Veteran
Joined
Apr 13, 2001
Messages
1,632
Purraise
1
Location
CT
Firstly, HAHAHAAAHHAHAHAHAHAHAHAHH vile... that's funny..

okay..

Start your computer in safe mode...
When you restart your 'puter AS SOON as it says "Starting Windows 98.."

Hit the F8 key, or reboot and hold the left shift key down the whole time, even if it beeps alot.


You should get a menu, select safe mode, it will start with a bunch of screen reminding you that you are in safe mode, and it will look nothing like what your used to.. colors off, big fonts etc...

Use my computer to find the files, select them and delete them. Occasionally that doesn't even work, but they really are going to be okay where they are.

You could also use DOS to delete them, but that's a whole other story.. try this first....

Ken
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
Ken!!!! Thanks for the help....but reading your last post just made my head spin around like that girl in the Exorcist!!


I am too much of a computer dummy to even know what you mean by "make sure your computer is in the safe mode" and that was only the first line!!


Maybe I should try to call someone who knows more about this than I do, who can come help me... I don't know if I can find anyone...but maybe I better try...as I am afraid if I try to do it myself, I will accidentally blow the whole dam* computer up!!! (is there a simile for smoke???? LOL)
This is depressing...
 

imagyne

TCS Member
Veteran
Joined
Apr 13, 2001
Messages
1,632
Purraise
1
Location
CT
Debby...

The rest of the email explains how to get your computer into safe mode... the rest is easy.. try it... goooo oooonnnn try it... you can't break it by doing it....... well, just don't delete the wrong files...

Ken
 

debby

TCS Member
Veteran
Joined
Nov 5, 2000
Messages
10,983
Purraise
4
Location
Iowa
But I don't even know what files to delete...or even if I SHOULD delete them!!!
I think I better get some help. Thank you for all your help, I wish you lived closer so you could come fix this dang thing for me!!!
 
Top