body.scr - problem?

[Mark Cassino]

I just got an email from someone I don't know, with no text, just an
attachment called "body.scr."

I have Norton Anti Virus 2003 on my system. I scanned the attachment, and
NAV says it is not infected. My virus defs are up to date, but this is
obviously some sort of virus / worm / torjan / whatever, so it seems to be
something beyond NAV's abilities.

And idea what this virus is? I got burned a few years ago when NAV missed a
virus that later trashed my system, so while it seems to be competent
software, I don't place unwaivering faith in it.

Thanks in advance -

MCC

 

[David H. Lipman]

It "may" be the new "HOT" virus...
W32/Mydoom@MM - http://vil.nai.com/vil/content/v_100983.htm

If you saved the file, DON'T EXECUTE IT, but you can go to McAfee
http://www.mcafee.com/myapps/mfs/default.asp and perform an online scan of your platform
then report back your results. Otherwise just delete the email.

Dave



| I just got an email from someone I don't know, with no text, just an
| attachment called "body.scr."
|
| I have Norton Anti Virus 2003 on my system. I scanned the attachment, and
| NAV says it is not infected. My virus defs are up to date, but this is
| obviously some sort of virus / worm / torjan / whatever, so it seems to be
| something beyond NAV's abilities.
|
| And idea what this virus is? I got burned a few years ago when NAV missed a
| virus that later trashed my system, so while it seems to be competent
| software, I don't place unwaivering faith in it.
|
| Thanks in advance -
|
| MCC
|
|

 

[Pepperoni]

These things are often passed as screen savers, but are actually scrap
files. Windows always hides the true (.shs) file extension, so they can
actually be passed as anything. They are a notepad file, made executable by
the embedding of benign or malicious script using Object Linking and
Embedding (OLE).
http://www.pc-help.org/security/scrap.htm
http://www.computeruser.com/newstoday/99/11/01/news2.html
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q138275
http://www.computeruser.com/news/00/06/20/news4.html

 

[FromTheRafters]

I just got an email from someone I don't know, with no text, just an
attachment called "body.scr."

I have Norton Anti Virus 2003 on my system. I scanned the attachment, and
NAV says it is not infected.

Are you sure it didn't say "no viruses were found"?
That is a different thing entirely. Absence of evidence
is not evidence of absence.

My virus defs are up to date, but this is
obviously some sort of virus / worm / torjan / whatever, so it seems to be
something beyond NAV's abilities.

It's new, and "up-to-date" is a relative thing.
W32/Mydoom@mm

And idea what this virus is? I got burned a few years ago when NAV missed a
virus that later trashed my system, so while it seems to be competent
software, I don't place unwaivering faith in it.

This attitude should be for all AV software ~ none are 100% effective.

 

[MCC]

Thanks to the folks who replied...

After posting my first message, I checked email and got several messages
from mail servers either saying that I sent a message to an invalid email
address, or that my message was rejected due to having an infected
attachment. This obviously confirmed that my system is infected.

One of the error messages identified the attachment as being infected with
MIMAIL-Q.

I went to the Trend Microsystems site and did a web scan, and that detected
two variants of the MIMAIL virus in files in my attachments folder -
including the body.scr file. It id's these as MIMAIL-L and P.

I just pulled the wireless interface off the PC then, and dug up this old
laptop to use for web access. Symantec has not posted a fix for the
MIMAIL-Q (a few hours later than I needed it) so I put my primary desktop
back on line and am now following the directions to get rid of it (a full
system scan is in process.)

Many thanks -

MCC

 

[Mark Cassino]

I just pulled the wireless interface off the PC then, and dug up this old
laptop to use for web access. Symantec has not posted a fix for the
MIMAIL-Q (a few hours later than I needed it) so I put my primary desktop
back on line and am now following the directions to get rid of it (a full
system scan is in process.)

Well, that should be that Symantec _has_ posted the fix... and it seems to
be working....

- MCC

 

[FromTheRafters]

Thanks to the folks who replied...

After posting my first message, I checked email and got several messages
from mail servers either saying that I sent a message to an invalid email
address, or that my message was rejected due to having an infected
attachment. This obviously confirmed that my system is infected.

This may very well be, but I have heard that this one also
spoofs addresses so bounces are not necessarily an indication
of infection.