Messages like this are often hoaxes. Are you sure some spammer didn't
take a real McAfee advertising letter, doctor it up, tack on a new subject
line and forge the return address?
It's hard to believe Network Associates would misspell "virus" in the
subject line of a letter to thousands of customers. Or end the message
with a reference to a "marketing policy" that they haven't followed.
Still, just in case, I'm sending a copy to my company's IT department.
:-)
And it's ALWAYS good advice to avoid executing programs attached to e-mails.
----- Begin Included Message -----
From [log in to unmask] Fri Dec 10 00:36:05 1999
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Message-ID: <[log in to unmask]>
Date: Fri, 10 Dec 1999 13:24:46 +0800
Reply-To: "[log in to unmask]" <[log in to unmask]>
Comments: RFC822 error: <W> TO field duplicated. Last occurrence was
retained.
Comments: RFC822 error: <W> TO field duplicated. Last occurrence was
retained.
Comments: RFC822 error: <W> TO field duplicated. Last occurrence was
retained.
Organization: Edith Cowan University
Subject: FW: Virius Alert - W32/ExploreZip.worm.pak
X-To: "Wojciech Kuczborski (E-mail)" <[log in to unmask]>,
"[log in to unmask]" <[log in to unmask]>
To: [log in to unmask]
From: "[log in to unmask]" <[log in to unmask]>
X-Topic: Ada
X-Match: "[log in to unmask]" <[log in to unmask]>
X-Lines: 103
Status: RO
-----Original Message-----
From: McAfee.com Dispatch [SMTP:[log in to unmask]]
Sent: Wednesday, December 01, 1999 2:43 PM
To: [log in to unmask]
Subject: Virius Alert - W32/ExploreZip.worm.pak
((((((((((( McAfee.com Dispatch ------ VIRUS ALERT )))))))))))))
[This message is brought to you as a subscriber to the
McAfee.com Dispatch. To unsubscribe, please follow the
instructions at the bottom of the page.]
************ W32/ExploreZip.worm.pak ****************
Dear McAfee.com Dispatch Subscriber:
W32/ExploreZip.worm.pak is a new, compressed variant of the
original W32/ExploreZip.worm. AVERT has assessed it as a
high-risk threat, approaching outbreak levels! It reproduces
itself by sending replies to incoming email messages, with
itself as an attachment called "zipped_files.exe".
It includes a payload: it will search the user's mapped
drives and overwrite all files of types .c, .cpp, .asm,
.doc, .xls, .ppt. to zero Kb.
IMPORTANT - If you receive an email with the message
"I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.",
DELETE IT IMMEDIATELY! It will have an attachment called
"zipped_files.exe"; DO NOT DOUBLE-CLICK OR RUN THIS
ATTACHMENT! If you do, it will infect your system!
VirusScan 4.0.25 and above requires the EXTRA.DAT
(W32exp-4.zip) to detect and remove W32/ExploreZip.worm.pak.
VirusScan 3.x cannot detect W32/ExploreZip.worm.pak because
it arrives in a compressed form. Users of VirusScan 3.x
should upgrade to the latest version.
Note: If you are using McAfee Clinic [Active Shield (TM)],
please click here to get the update.
-> http://clinic.mcafee.com/clinic/virusscan/activeshield
-- McAfee.com
_______________________ Virus Fixes ______________________________
Find out more about this virus. Click here to go to the
W32/ExploreZip.worm.pak Help Center.
-> http://www.mcafee.com/viruses/explorezip.pak/
Check if your system is infected, click here to use
VirusScan Online.
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1105
Purchase the latest copy of VirusScan, please click here.
-> http://store.mcafee.com/category.asp?CatID=3&CategoryLevel=1&rfr=VSCALRT
Upgrade to the latest VirusScan. Purchase the VirusScan
Maintenance Plan which entitles you to 12 months of
upgrades, click here.
-> http://store.mcafee.com/category.asp?CatID=18&CategoryLevel=1&rfr=VRSPLN
Download the latest DAT files, click here.
-> http://download.mcafee.com/updates/updates.asp
_____________________ New Clinic Applications ______________________
Try out the two latest applications on McAfee Clinic:
Application Remover -
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1103
Application Restorer -
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1104
______________________________________________________________________
Unsubscribe: If you do not want receive the McAfee.com
Dispatch in the future, click here.
-> http://www.mcafee.com/unsubscribe
This Virus Alert has been issued by the Network Associates
Anti-Virus Emergency Response Team (AVERT). McAfee.com is a
wholly owned subsidiary of Network Associates.
Copyright 1999 McAfee.com / All Rights Reserved.
______________________________________________________________________
This message was sent by McAfee.com using Responsys Interact.
To view our permission marketing policy:
http://www.rsvp0.net
----- End Included Message -----
|