NEW VIRUS MAKING THE ROUNDS

[Shannen Durphey]

I just recieved a message from the DIY list with a virus attached, named
"geocitie.pif"  This can be a tough one to remove.  I just finished helping my
father clean it from his computer.

PLEASE do not trust Norton to scan it.  Norton doesn't know it's there.  Double
clicking on the attachment will allow you to directly run the program, completely
bypassing Norton.  The real telltale that something's not right is that most .pif
files are around 2-3k long, where this file is 19k.

The virus came from "scotty at cyberverse.com" and is automagically sent whenever the
infected pc sends a non infected email.  It's interesting that there's no other
email with this.  The experience that I had was that the virus did not alter the
sender's address in the message with the virus attached.

Look for W95.MTX.dr as a virus name.  There's more info here:
http://www.symantec.com/avcenter/venc/data/w95.mtx.html

Be warned that if you've been infected, the virus will block access to symantec.com
and other sites.  I have copies of the instructions for removing it.


Shannen
----------------------------------------------------------------------------
To unsubscribe from diy_efi, send "unsubscribe diy_efi" (without the quotes)
in the body of a message (not the subject) to majordomo at lists.diy-efi.org