On Thu, 29 Nov 2001, Peter Bergstrom wrote:

> I just got a response to my recent posting on the "List of the Living ..."
> from "Dot Burford [[log in to unmask]]" which contained a copy of
> w32.badtrans.b @mm.  Fortunately my Anti Virus picked this up and cleaned it
> up, but when I sent a note to the above mentioned address warning them of
> their problem, I got a return of undeliverable.

The W32.badtrans.b worm adds an underscore to the beginning of the return
address of the unwitting sender.  If you had sent your warning to dotb
instead of _dotb, it would have reached her.  If your mailer shows the
return address of the sender and it has an initial underscore, treat that
message with caution, and if it has an attachment, dump the whole thing
immediately.

Also, after those of you who caught the virus (or worm) have disinfected
your machines, change any and all passwords you had on it or typed in
while infected, since part of the worm's intention is to collect
keystrokes and send them to the worm's originator.  Also consider the
possibility your credit cards have been compromised if you used them for
online purchases.

Finally, either get a better mailer than Outlook, which is a virus magnet,
or change its settings so that it won't automatically launch applications.
For whatever unconscionable reason, Microsoft apparently has the default
set to open and launch.  I've never worked with Outlook, so cannot advise
exactly how to change its settings.

Good luck, all.

Mario Rups
[log in to unmask]

To subscribe, change options, or unsubscribe, please see the instructions
at http://listlva.lib.va.us/archives/va-hist.html