<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2650.12">
<TITLE>RE: ES - virus warning - from ListAdmin</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Ladies and gentlemen of the List,</FONT>
</P>
<P><FONT SIZE=2>I apologize in advance since this is not 'first hand' information, but here goes...</FONT>
</P>
<P><FONT SIZE=2>The panther.exe file is one form of the W32.NewApt.Worm virus. The HyperLink version of this Virus was posted to the Ansteorran list the other day. This is very likely the source of Gilli's infection (He followed the link to the Website listed there which infected him).</FONT></P>
<P><FONT SIZE=2>Since this virus affects Outlook users, it has access to their addressbook, which is why lots of folks Gilli knows got the message. It is very likely using the Sent Mail folder to capture subject lines you hace used as well. The full text from Symantec.Com (makers of Norton Anti-Virus, a very reputable source) is included below. I do not believe this is a case of someone abusing the list, simply a more widespread infection that happen to hit Ansteorra@ansteorra.org which we have alot of cross-subscribers to, etc.</FONT></P>
<P><FONT SIZE=2>Timothy of Glastonbury</FONT>
<BR><FONT SIZE=2>mka Tim Rayburn</FONT>
<BR><FONT SIZE=2>Protégé to Viscount Galen of Bristol</FONT>
</P>
<BR>
<P><FONT SIZE=2><BEGIN QUOTE FROM SYMANTEC.COM></FONT>
</P>
<P><FONT SIZE=2>W32.NewApt.Worm </FONT>
</P>
<P><FONT SIZE=2>Detected as: W32.NewApt.Worm </FONT>
<BR><FONT SIZE=2>Aliases: Worm.NewApt </FONT>
<BR><FONT SIZE=2>Infection Length: 69,632 bytes </FONT>
<BR><FONT SIZE=2>Likelihood: Common </FONT>
<BR><FONT SIZE=2>Region Reported: US, Europe </FONT>
<BR><FONT SIZE=2>Characteristics: Worm </FONT>
</P>
<P><FONT SIZE=2>Norton AntiVirus users can protect themselves from this virus by downloading the current virus definitions either through LiveUpdate or from the Download Virus Definition Updates page. </FONT></P>
<BR>
<BR>
<BR>
<P><FONT SIZE=2>Description </FONT>
</P>
<P><FONT SIZE=2>W32.NewApt.Worm was discovered on December 14, 1999 in Italy. This worm will email itself out when receiving email via Microsoft Outlook or Netscape Navigator. When activated, the worm will display an error dialog and modify the registry so the worm is reloaded each time the computer is restarted. The error message box will appear as: </FONT></P>
<P><FONT SIZE=2> </FONT>
</P>
<P><FONT SIZE=2>When received by email (and if you do not have an HTML capable email client), the message body will be: </FONT>
</P>
<P><FONT SIZE=2>he, your lame client cant read HTML, haha.</FONT>
<BR><FONT SIZE=2>click attachment to see some stunningly HOT stuff</FONT>
</P>
<P><FONT SIZE=2>Otherwise, the text will include a reference to a website and the following message: </FONT>
</P>
<BR>
<P><FONT SIZE=2>Hypercool Happy Year 2000 funny programs and </FONT>
<BR><FONT SIZE=2>animations....</FONT>
<BR><FONT SIZE=2>We attached our recent animation from this </FONT>
<BR><FONT SIZE=2>site in our mail ! Check it out!</FONT>
</P>
<P><FONT SIZE=2>Attached to the message will be one of the following file names: g-zilla.exe, cooler3.exe, cooler1.exe, copier.exe, video.exe, pirate.exe, goal1.exe, hog.exe, party.exe, saddam.exe, monica.exe, boss.exe, farter.exe, cheeseburst.exe, panther.exe, theobbq.exe, goal.exe, baby.exe, bboy.exe, cupid2.exe, fborfw.exe, casper.exe, irnglant.exe, or gadget.exe </FONT></P>
<P><FONT SIZE=2>The worm will add the following registry key: </FONT>
</P>
<P><FONT SIZE=2>HKLM/Software/Microsoft/Windows/CurrentVersion/</FONT>
<BR><FONT SIZE=2>Run/tpawen </FONT>
<BR><FONT SIZE=2>To remove the worm from memory, remove the above registry key and then restart. Delete all infected files. </FONT>
<BR><FONT SIZE=2> </FONT>
</P>
</BODY>
</HTML>