Previous 1
Topic: More virus alerts
whispertoascream's photo
Mon 02/05/07 02:08 PM
I just got this e.mail and thought I would copy and paste it here for
all to beware of.


just verified this with Snopes and it is REAL.

PLEASE INFORM EVERYONE

Emails with pictures of Osama Bin-Laden hanged are being sent and the
moment that you open these emails your computer will crash and you will
not be able to fix it!


If you get an email along the lines of "Osama Bin Laden Captured"

or "Osama Hanged"don't open the attachment.This e-mail is being
distributed through countries around the globe, but mainly in the US and
Israel .

Be considerate & send this warning to whomever you know.

PLEASE FORWARD THIS WARNING AMONG FRIEN DS, FAMILY AND CONTACTS:


You should be alert during the next days:
Do not open any message with an attached filed called


"Invitation" r egardless of who sent it.


It is a virus that opens an Olympic Torch which "burns" the whole hard
disc C of your computer.


This virus wi ll be received from someone who has your e-mail address in
his/her contact list, that is why you should send this e-mail to all
your contacts.


It is better to receive this message 25 times than to receive the virus
and open it.


If you receive an e-mail called "invitation", though sent by a friend,
do not open it and shut down your computer immediately.


This is the worst virus announced by CNN, it has been classified by
Microsoft as the most destructive virus ever.


This virus was discovered by McAfee yesterday, and there is no repair
yet for this kind of virus.

This virus simply destroys the Zero Sector of the Ha rd Disc, where the
vital information is kept.





Help pass the word on guys maybe the more we get out the more it can
stop.

kojack's photo
Mon 02/05/07 02:16 PM
The Olympic Torch Hoax is being spread through email. It has been
reported that the following text of the hoax may differ slightly in the
various messages going around. This hoax email includes the following
warning: Subject: Invitation. This virus does not exist.

You should be alert during the next days:
Do not open any message with an attached filed called "Invitation"
regardless of who sent it .
It is a virus that opens an Olympic Torch which "burns" the whole hard
disc C of your computer. This virus will be received from someone who
has your e-mail address in his/her contact list, that is why you should
send this e-mail to all your contacts. It is better to receive this
message 25 times than to receive the virus and open it.

If you receive a mail called "invitation", though sent by a friend, do
not open it and shut down your computer immediately.

This is the worst virus announced by CNN, it has been classified by
Microsoft as the most destructive virus ever.
This virus was discovered by McAfee yesterday, and there is no repair
yet for this kind of virus.
This virus simply destroys the Zero Sector of the Hard Disc, where the
vital information is kept

Please ignore any messages regarding this hoax and do not pass on
messages. Passing on messages about the hoax only serves to further
propagate it

kojack's photo
Mon 02/05/07 02:20 PM
To remove the Osma virus do this :

Discovered: September 7, 2005
Updated: January 28, 2007 10:23:04 AM
Type: Worm
Infection Length: 41,192 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me,
Windows NT, Windows Server 2003, Windows XP


The following instructions pertain to all current and recent Symantec
antivirus products, including the Symantec AntiVirus and Norton
AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Remove all the entries that the risk added to the hosts file.
Update the virus definitions.
Run a full system scan and delete all the files detected.
Delete any values added to the registry.

For specific details on each of these steps, read the following
instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you
temporarily turn off System Restore. Windows Me/XP uses this feature,
which is enabled by default, to restore the files on your computer in
case they become damaged. If a virus, worm, or Trojan infects a
computer, System Restore may back up the virus, worm, or Trojan on the
computer.

Windows prevents outside programs, including antivirus programs, from
modifying System Restore. Therefore, antivirus programs or tools cannot
remove threats in the System Restore folder. As a result, System Restore
has the potential of restoring an infected file on your computer, even
after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even
though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows
documentation, or one of the following articles:
How to disable or enable Windows Me System Restore
How to turn off or turn on Windows XP System Restore

Note: When you are completely finished with the removal procedure and
are satisfied that the threat has been removed, reenable System Restore
by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me
System Restore, see the Microsoft Knowledge Base article: Antivirus
Tools Cannot Clean Infected Files in the _Restore Folder (Article ID:
Q263455).

To remove all the entries that the risk added to the hosts file

Navigate to the following location:


Windows 95/98/Me:
%Windir%
Windows NT/2000/XP:
%Windir%\System32\drivers\etc

Notes:
The location of the hosts file may vary and some computers may not have
this file. There may also be multiple copies of this file in different
locations. If the file is not located in these folders, search your disk
drives for the hosts file, and then complete the following steps for
each instance found.
%Windir% is a variable that refers to the Windows installation folder.
By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt
(Windows NT/2000).


Double-click the hosts file.
If necessary, deselect the "Always use this program to open this
program" check box.
Scroll through the list of programs and double-click Notepad.
When the file opens, delete all the entries added by the risk. (See the
Technical Details section for a complete list of entries.)
Close Notepad and save your changes when prompted.


3. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for
quality assurance before they are posted to our servers. There are two
ways to obtain the most recent virus definitions:
Running LiveUpdate, which is the easiest way to obtain virus
definitions: These virus definitions are posted to the LiveUpdate
servers once each week (usually on Wednesdays), unless there is a major
virus outbreak. To determine whether definitions for this threat are
available by LiveUpdate, refer to Virus Definitions (LiveUpdate).
Downloading the definitions using the Intelligent Updater: The
Intelligent Updater virus definitions are posted daily. You should
download the definitions from the Symantec Security Response Web site
and manually install them. To determine whether definitions for this
threat are available by the Intelligent Updater, refer to Virus
Definitions (Intelligent Updater).

The latest Intelligent Updater virus definitions can be obtained here:
Intelligent Updater virus definitions. For detailed instructions read
the document: How to update virus definition files using the Intelligent
Updater.


4. To scan for and delete the infected files
Start your Symantec antivirus program and make sure that it is
configured to scan all the files.
For Norton AntiVirus consumer products: Read the document: How to
configure Norton AntiVirus to scan all files.
For Symantec AntiVirus Enterprise products: Read the document: How to
verify that a Symantec Corporate antivirus product is set to scan all
files.
Run a full system scan.
If any files are detected, click Delete.

Important: If you are unable to start your Symantec antivirus product or
the product reports that it cannot delete a detected file, you may need
to stop the risk from running in order to remove it. To do this, run the
scan in Safe mode. For instructions, read the document, How to start the
computer in Safe Mode. Once you have restarted in Safe mode, run the
scan again.

After the files are deleted, restart the computer in Normal mode and
proceed with the next section.

Warning messages may be displayed when the computer is restarted, since
the threat may not be fully removed at this point. You can ignore these
messages and click OK. These messages will not appear when the computer
is restarted after the removal instructions have been fully completed.
The messages displayed may be similar to the following:

Title: [FILE PATH]
Message body: Windows cannot find [FILE NAME]. Make sure you typed the
name correctly, and then try again. To search for a file, click the
Start button, and then click Search.


5. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry
before making any changes to it. Incorrect changes to the registry can
result in permanent data loss or corrupted files. Modify the specified
subkeys only. For instructions refer to the document: How to make a
backup of the Windows registry.

Click Start > Run.
Type regedit
Click OK.

Note: If the registry editor fails to open the threat may have modified
the registry to prevent access to the registry editor. Security Response
has developed a tool to resolve this problem. Download and run this
tool, and then continue with the removal.


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value:

"[RANDOM VALUE]" = "%System%\[RANDOM FILE NAME].exe"


Exit the Registry Editor.




Writeup By: Mircea Ciubotariu

spay's photo
Mon 02/05/07 02:25 PM
I JUST THE INVITATION EMAIL, WHEN DOES MY COMPUTER FRY ? THAT WILL BE
COOL, THEN I GET TO GP HOME EARLY FROM WORK ! F*CK YA !

kojack's photo
Mon 02/05/07 02:30 PM
Spay why do you have to be so rude, she was only trying to help out ....

whispertoascream's photo
Mon 02/05/07 02:31 PM
Thanks for the add in Kojack

spay's photo
Mon 02/05/07 02:33 PM
KOJACK, HOW IS THAT RUDE ? PLEASE DONT START ANYTHING.

kojack's photo
Mon 02/05/07 02:34 PM
Anytime whisper

kojack's photo
Mon 02/05/07 02:44 PM
no need for vulgarity Spay.

Mon 02/05/07 02:25 PM
I JUST THE INVITATION EMAIL, WHEN DOES MY COMPUTER FRY ? THAT WILL BE
COOL, THEN I GET TO GP HOME EARLY FROM WORK ! F*CK YA !


spay's photo
Mon 02/05/07 03:21 PM
KOJACK, WHAT ARE YOU TALKING ABOUT MAN ? PLEASE LEAVE ME ALONE, OR I
WILL REPORT ABUSE. THANK YOU.

michael1313's photo
Mon 02/05/07 05:28 PM
*taking notes*

michael1313's photo
Mon 02/05/07 05:31 PM
thanx for th virus updates...

I'm keeping an eye on things...smokin

FedMan's photo
Mon 02/05/07 07:31 PM
that same message has been circulating since 20000 it is a hoax


http://www.snopes.com/computer/virus/invitation.asp

FedMan's photo
Mon 02/05/07 07:32 PM
2000 lol

FedMan's photo
Mon 02/05/07 07:34 PM
oh yeah I meant the olympic torch virus

FedMan's photo
Mon 02/05/07 07:37 PM
Osama Bin Laden Virus Warning Hoax



Type: Malware Related

Discovery Date: Apr 9, 2006 12:00:00 AM GMT -0800

Last Reported Date: Apr 9, 2006 12:00:00 AM GMT -0800

Description:


This email hoax warns users that email messages offering pictures of
Osama Bin Laden hanged or captured contain a destructive virus that
causes affected systems to crash.

While the said email messages have been used by several malware, this
warning, or variations of this warning, are already outdated. Users are
therefore advised to keep their antivirus software up-to-date, and to
refrain from forwarding similar messages to other users.

Original Message:
PLEASE INFORM EVERYONE!!!!!!!!!!!!!!!!!

Emails with pictures of Osama Bin-Laden hanged are being sent and
the moment that you open these emails your computer will crash
and you will not be able to fix it!

This e-mail is being distributed through countries around the
globe, but mainly in the US and Israel.

Don't be inconsiderate; send this warning to whomever you know.
If you get an email along the lines of "Osama Bin Laden Captured"
or "Osama Hanged" don't open the attachment.



Description Created: Apr 9, 2006 3:28:35 PM GMT -0800

FedMan's photo
Mon 02/05/07 07:37 PM
that came from trend micro

kojack's photo
Mon 02/05/07 07:46 PM
hmmm but he wasnt hung in april. but okay

FedMan's photo
Mon 02/05/07 07:51 PM
Osama wasn't hung period

whispertoascream's photo
Tue 02/06/07 08:23 AM
Osema was to hung

Previous 1