This is from the husband of a subscriber/friend/relative---
(we found out the "hard way"!!)
There is a virus going around that when you click on the attachment, even
once, it installes itself, looking like a system program called 'inetd.exe'
which is a Unix program unless you have unix-type software running at the
same time as Windows (Interix, Windows Services For Unix, for example). It
then replies to all further incoming messages with itself as an attachment,
with the message text as "Take a look to the attachment". It also truncates
the e-mail after a few lines, ending in the middle with "....." We had 968
e-mails in the Outbox within 5-7 minutes, but none of them had been sent
since I have Outlook set to send/recieve every 10 minutes.
To remove: Look in the Windows system directory for 'inetd.exe' and delete
it. If you're not sure, rename it and/or move it to a different folder.
Edit the registry by running 'regedit.' Be very careful. Under edit, pick
find, and delete all occurances. The registry key will look like "RUN
C:\WINDOWS\INETD.EXE.
Exit 'regedit.'
Delete all incoming, outgoing and sent mail with this attachment.
The attachment originally comes in as "setup.pif" and it's size is 13,132
in
size. It then mutates into many random file names. I have seen 'docs.scr'
fun.pif hamster.ZIP.scr, for example.
After deleting the file and removing the registry entries, re-boot so the
existing program stops running. If you don't feel comfortable editing the
registry, removing or renaming the file will still prevent the virus from
running again, but you will see an error message indicating that "INETD.EXE"
couldn't be found, or something along those lines.
It took me about 3 hours to get this bad boy nailed down and when I figured
out how I was re-infecting myself (doing my own "self tests") ---did I get
to this point.
Let me know is this doesn't work for you, e-mail me at biteme(a)wt.net. Yes,
it real, but byteme (as in a computer's "Byte") wasn't available. I
didn't
intend to sound offensive... Greg
-----Original Message-----
From: Lori Orsette [mailto:llo@mediaone.net]
Sent: Thursday, April 19, 2001 9:07 PM
To: MIGEN-L(a)rootsweb.com
Subject: [MIGEN-L] Odd Emails
Is anyone else getting emails from "Public Anonymous_Account>"???
Thanks,
Lori
______________________________