Virus Attack Follow Up

[David Nettleton]

Dear All,

Following Louis's suggestions I have been able to eradicate the Bride
virus
manually by removing the mystey help and explorer files from my desktop,
regedit.exe from my windows/system folder and Bride.exe. It appears to
have
gone for now anyway, I think I was lucky in not having the funlove worm
spread (my anti-virus software caught it)- the funlove identifying
flcss.exe
never appeared.
In order to stop windows crashing i prevented certain software like
antivirus and norton software from booting up with windows ( switched
them
off in safe mode).  I hope this may help anyone in trouble.
I still need to find a backup copy of msconfig.exe, which does not
appear to
be on the windows cdrom, if anyone has the answer please let me know.

regards

David Nettleton

----- Original Message -----
From: "Louis Florit" <Louis.Florit at noaa.gov>
To: "coral-list" <coral-list at coral.aoml.noaa.gov>
Sent: Friday, November 08, 2002 5:16 PM
Subject: Virus Attack Follow Up

> Dear coral-listers:
>
> I've recieved some questions regarding the nature of the virus and would
> like to offer some more details:
>
> The virus that was sent out over the list infects Windows operating
> systems only; this includes Windows 95/98/2000/NT and XP.
>
> If you use a Macintosh or UNIX based system you should not have an
> infection, as this virus targets Windows only.
>
> The virus automatically installs itself if loaded through an unpatched
> version of Microsoft Outlook via the IFrame vulnerability; if you have
> updated your system regularly it would have not infected your system
> automatically.  The update from Microsoft can be found here:
>
>
http://www.microsoft.com/windows/ie/downloads/critical/q323759ie/default.asp
>
> If you use Eudora, Netscape, Pine, or any other email client, the only
> way to be infected is by accidentally opening and excuting the attached
> virus.  If you deleted the message, you should be ok.
>
> Finally, this virus, and various others, forge the sender address.  This
> means you may have recieved a notice (or several hundred) that you sent
> someone a virus, when in fact you haven't.  If you start recieving a
> multitude of messages rejecting infected email, and you have scanned
> your system with the latest virus definitions, it is likely that this is
> what occured and you are not infected.
>
> If I can answer any further questions, please do not hesistate to
> contact me at this email address.  Thank you.
>
> Louis Florit
> Coral-List Tech Admin
>
> --
>   All programmers are optimists  -- Frederick P. Brooks, Jr.
> ~~~~~~~
> For directions on subscribing and unsubscribing to coral-list or the
> digests, please see http://www.coral.noaa.gov/lists/coral-list.html .
>
~~~~~~~
For directions on subscribing and unsubscribing to coral-list or the
digests, please see http://www.coral.noaa.gov/lists/coral-list.html .