I just got a virus from GALA-L

Webster webster at 3RI.NET
Thu Aug 14 06:58:04 UTC 2003


My Norton AntiVirus tells me I just got multiple viruses from
multiple sendings with the header:

Sender: ana maria martirena <amartir at FI.UBA.AR>
Recipient: GALA-L at LISTSERV.LINGUISTLIST.ORG
Subject: unica direccion de correo en el futuro/ only mail mail
addressfrom now on

<snip>
The virus is JS.Fortnight (AKA some other names, too, usually
containing JS in them), which Symantec's anti-virus site
describes as:

JS.Fortnight.C is a Trojan Horse that drops a file, which is
then inserted into the default signature of Microsoft Outlook
Express. Following this, every time you send email using Outlook
Express, the message will contain code that will attempt to go
to a specific Web site when the recipient opens the email
message.

JS.Fortnight.C exploits a Microsoft VM vulnerability using
IFRAME tags, with the SRC field set to the address of the
Trojan's creator. After a series of redirections, an encoded
JavaScript will load an applet containing the exploit. On
unpatched systems, various registry keys and Web browser
settings will be modified.
<snip>


This is not an "urban legend" type of watch-out-for-this-virus
story -- rather, I just received this from the GALA list.

Y'all be careful out there!
M. Webster



More information about the Gala-l mailing list