[Dshield] FW: New virus alert: W32/Bugbear.B-mm

Johannes B. Ullrich jullrich at sans.org
Thu Jun 5 16:44:16 GMT 2003


This one is fun in that it includes random excerpts and
subjects from the infected persons e-mail client (remember
Sircam?). The first one I got was a message with excerpts
about a HIPAA compliance discussion ;-)



On Thu, 2003-06-05 at 11:35, Deb Hale wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Yes - Providing people are using AV or even aware that these things exist.  Problems is they don't and aren't.  I have already had 4 this morning.  Deb
> 
> Deborah F Hale
> Certified Business Continuity Professional
> BCP Enterprise, Inc
> Telephone: (712) 252-0361
> www.bcpenterprise.com
>  
> 
> 
> - -----Original Message-----
> From: list-bounces at dshield.org [mailto:list-bounces at dshield.org] On Behalf Of John Hardin
> Sent: Thursday, June 05, 2003 10:05 AM
> To: General DShield Discussion List
> Subject: Re: [Dshield] FW: New virus alert: W32/Bugbear.B-mm
> 
> 
> On Thu, 2003-06-05 at 06:14, Deb Hale wrote:
> > 
> > It's BACKKKKK!  Bugbear.B
> 
> ...
> 
> > Attachment names are also variable, possibly based on from filenames 
> > found on the infected machine with an extension of either .scr, .pif 
> > or .exe
> 
> Trivially easy to block.
> 
> - -- 
> John Hardin  KA7OHZ                           <johnh at aproposretail.com>
> Internal Systems Administrator                    voice: (425) 672-1304
> Apropos Retail Management Systems, Inc.             fax: (425) 672-0192
> - -----------------------------------------------------------------------
>   ...the Fates notice those who buy chainsaws...
>                                              -- www.darwinawards.com
> - -----------------------------------------------------------------------
>  41 days until Apropos Forum 2003
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.0
> 
> iQA/AwUBPt9jTzxOOHZjYde8EQLRGACg7Vx/y/snoecto0fr54WNyhnbIZ4An00T
> OurH5A5NNEH2JE/oG6GQjUwn
> =XeeQ
> -----END PGP SIGNATURE-----
> 
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list