LL-L "Virus" 2001.12.04 (02) [E]

[Lowlands-L]

======================================================================
 L O W L A N D S - L * 04.DEC.2001 (02) * ISSN 189-5582 * LCSN 96-4226
 Web Site: <http://www.geocities.com/sassisch/rhahn/lowlands/>
 Rules: <http://www.geocities.com/sassisch/rhahn/lowlands/rules.html>
 Posting Address: <lowlands-l at listserv.linguistlist.org>
 Server Manual: <http://www.lsoft.com/manuals/1.8c/userindex.html>
 Archive: <http://listserv.linguistlist.org/archives/lowlands-l.html>
=======================================================================
 A=Afrikaans Ap=Appalachian D=Dutch E=English F=Frisian L=Limburgish
 LS=Low Saxon (Low German) S=Scots Sh=Shetlandic Z=Zeelandic (Zeeuws)
=======================================================================

From: R. F. Hahn <sassisch at yahoo.com>
Subject: Virus

Dear Lowlanders,

I am passing on to you a genuine computer virus warning circulated by our
computing administration.  You would do well to take note of it and to protect
yourselves accordingly.

Regards,
Reinhard/Ron

====Beginning Quote====

Per the Security Infrastructure Team at AMCIS, there is a new virus going
around. Currently, the Anti-Virus companies do not have software updates
available at this time. Please do not open any emails with the subject
"Hi".

Please read the information below for details, we will keep you updated as
new information arises.

http://vil.nai.com/vil/virusSummary.asp?virus_k=99272

According to this report, this virus deletes anti-virus files
(although its not clear which "certain anti-virus product" files are
 deleted.)

 http://www.norman.com/virus_info/w32_goner_a_mm.shtml
 General characteristics
   a.. Type: Worm
   b.. Spreading mechanism: Email, other
   c.. Email characteristics:
     a.. Subject: Hi
     b.. Body:
     How are you ?
     When I saw this screen saver, I immediately thought about you
     I am in a harry, I promise you will love it!
     c.. Attachment: GONE.SCR
   d.. Destructivity: Medium
   e.. Payload: Deletes antivirus files
   f.. Detected by virus detection files published: 04 Dec 2001
   g.. Virus characteristics first published: 04 Dec 2001 13:47 (CET)
   h.. Virus characteristics latest update: 04 Dec 2001 17:43 (CET)
 Additional description of malicious program
 Type
 This is an email and ICQ worm.

 Spreading mechanism
 When executed, it will first display a small animated picture, which
 will be immediately followed by an error message. After this it will
 mail itself to all addresses in the Outlook address book.

 The worm copies itself to the Windows system directory under the name
 GONE.SCR and sets the registry key
 HKLM\Software\Microsoft\Windows\CurrentVersion\Run to point to this.

  If ICQ is installed on the infected computer, the worm will attempt to
  send itself to other ICQ users online.

 Destructivity and Payload
 The worm tries to stop processes and delete files belonging to certain
 antivirus products.

 It will also in some cases install some flood scripts to the Internet
 Relay Chat client mIRC.

====End Quote====

==================================END===================================
 You have received this because your account has been subscribed upon
 request. To unsubscribe, please send the command "signoff lowlands-l"
 as message text from the same account to
 <listserv at listserv.linguistlist.org> or sign off at
 <http://linguistlist.org/subscribing/sub-lowlands-l.html>.
=======================================================================
 * Please submit postings to <lowlands-l at listserv.linguistlist.org>.
 * Postings will be displayed unedited in digest form.
 * Please display only the relevant parts of quotes in your replies.
 * Commands for automated functions (including "signoff lowlands-l") are
   to be sent to <listserv at listserv.linguistlist.org> or at
   <http://linguistlist.org/subscribing/sub-lowlands-l.html>.
 * Please use only Plain Text format, not Rich Text (HTML) or any other
   type of format, in your submissions
=======================================================================