From: "Paul Tanner-Tremaine" <>
Subject: [ZA] THE EMAIL VIRUS - Bugbear / Tanatos
Date: Wed, 2 Oct 2002 14:43:27 +0100
The Virus that is doing the rounds is rather a nasty. It has the
capabilities of doing mass-mailings from a pc, recording your keystrokes to
get your passwords, etc, and sends them off to the hacker. It can also play
havoc with networks and network printers. It changes it's own name and file
names at random, and will send random emails with random content - that's
why we are seeing funny emails.
It first appeared in the wild on 30th of September 2002, and if you received
it, it checked to see if you had a firewall or antvirus software running
that did not identify it, and shut those applications down! Nearly all the
anti-virus companies put out warnings and a fix to their software within a
day or two, and you MUST update your antivirus software to stop further
attacks.
If your pc has been infected, it can be cured quite easily. Visit either of
these two sites for a description of the worm, and how to manually fix your
system.
http://www.f-secure.com/v-descs/tanatos.shtml
http://securityresponse.symantec.com/avcenter/venc/data/ type="text/javascript">DisplayMail('mm.html','w32.bugbear');
It appears to be prevalent in the rootsweb community at the moment - from
what I have read and seen on the other mailing lists, most of the initial
emails seem to have come from the .au and .nz areas, and now also the .uk
community, besides the .za lists. Followed the sun on the 30th, by the
looks of things..
If any weird email arrives that has an unexpected attachment, zap it without
opening it. I have had attachments Cock.FTW.EXE, testing.mdb.scr,
readme.scr, Thesaur.lex.exe, ASB BANK.htm.pif, plus some what look like half
finished genealogy emails. Anything from an unknown sender, with a funny
attachment - delete it quick, without opening the attachment!
Paul Tanner-Tremaine
e-mail: mailto:
Web page at http://members.tripod.com/paul_tannertremaine/
formerly in sunny Westville, Natal Coast, South Africa, now in
Wokingham, Berkshire, UK.
searching : AYLWARD; BOWKER; BRABBIN; MITFORD; MONKHOUSE; OSBALDESTON;
PENN; IRISH; DAVID; HEYWOOD; PARKS and TANNER-TREMAINE, among others....