Numptie

I've had several emails now with the subject "RE: Movie".

The text reads; "Please see the attached zip file for details.".

The attached file is your_details.zip

They have come from different addresses but replies bounce. One of the addresses was from the domain exxon.com.

Clearly I do nothing except delete / delete.

I reckon I'm being sent this fella.

Any ideas what action I could take ?

[Edited by Numptie - 7/5/2003 2:17:59 PM]

IanW

N,

It does sound very like 'W32/Sobig.e@MM' to me.

All that you can really do is make sure that you keep your Virus Scanner up to date and just let it deal with it before you get to the message.

If you are worried that you may have been infected, tehn run the Stinger to see if you have been infected as this can remove the virus for you.

Ian

Numptie

Thanks Iain.

Long time no speak !

IanW

No worries Numptie!

I have been a bit pre-occupied teh past few weeks, but I should be getting back to normality (well as normal as I will be seeing for a LONG time!).

Numptie

Just did the Stinger thing and, yes indeedee, the report reads ...

McAfee AVERT Stinger Version 1.7.6 built on Jul 3 2003
Copyright (C) 2001-2002 Networks Associates Technology, Inc. All Rights Reserved.
Virus data file v1000 created on Jul 3 2003.
Ready to scan for 17 viruses, trojans and variants.

Scan initiated on Sat Jul 05 14:31:15 2003
C:\WINDOWS\SYSTEM\CCJV.EXE
Found the W32/Bugbear@MM virus !!!
C:\WINDOWS\SYSTEM\CCJV.EXE has been deleted.
C:\_RESTORE\TEMP\A0088394.CPY
Found the W32/Bugbear@MM virus !!!
C:\_RESTORE\TEMP\A0088394.CPY could not be repaired.
C:\_RESTORE\ARCHIVE\FS691.CAB\A0088114.CPY
Found the W32/Sobig.e@MM virus !!!
C:\Windows\Start Menu\Programs\StartUp\ggo.exe
Found the W32/Bugbear@MM virus !!!
C:\Windows\Start Menu\Programs\StartUp\ggo.exe has been deleted.
C:\Windows\winssk32.exe
Found the W32/Sobig.e@MM virus !!!
C:\Windows\winssk32.exe has been deleted.
C:\Recycled\Dc13.scr
Found the W32/Bugbear@MM virus !!!
C:\Recycled\Dc13.scr has been deleted.

Number of clean files: 34166
Number of infected files: 6
Number of files deleted: 4



Should I be worried about the two files which could not be repaired / weren't deleted ?

TIA

IanW

N,

See http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm this page and tehn run stinger again, it should deal with the other 2 files then.

Ian

Numptie

Thanks Iain ... all sorted now