New virus arrives in a msg with the subject line Hi.

Extra driver here www.californear.com/extra.dat

Users of McAfee ASaP should update now by double clicking their icon in the system tray.

More info later, bit busy with this one.

 

Keep us updated please Jack. Is it an attachment payload?

 

Just looked - .scr file.

 

Look for and block if you can gone.scr

 

Look for and block if you can gone.scr

 

Groupshield traps all .SCRs for us anyway.

ScoobyNet beats Enterprise SecureCast again

 

That's almost funny

 

http://vil.nai.com/vil/virusSummary.asp?virus_k=99272

More info there

Jack,

whats the difference between Extra.dat and Super Extra.Dat ????

 

Super contains an engine update as well.

 

Ahh same deal as superDat then!

already running 4160 so just the Extra Dat for me!

 

OK,

Our company already runs DAT 4173 and Engine 4160, so why didn't it cure the virus on our system? I had to block the gone.scr file and luckily everyone has been briefed on NOT opening e-mails with those sorts of messages so no infected PC's/Servers.

Those updates on the NAI site are for the 4173 engine, but it clearly states you need 4174 to cure it. Anyone know where we can download the newer DAT file?

Stefan

 

I've placed the extra.dat on my page in case our site is too busy. The link is in the first post of this thread. This virus was discovered today, your DAT files were produced last week.

 

OK,

So although the DAT still reports itself as 4173, it is newer? I updated the PC here, but I'll go do the servers now and let you know.

Thanks,
Stefan

 

Thanks for confirming things Jack.

Just updated our servers and ran a scan on the quarantined gone.scr files - now detects them as proper viruses and deletes them.

Stefan

 

 

4174 drivers will be posted shortly to cover this threat.

 

Just grabbing 4174 now.

Thanks for the heads up Jack - much appreciated

 

I think the rest of the world must be getting 4174 as well. 1KB a second...