SC - Re: Cata, cats, cats, out of the garden

[Aelfwyn@aol.com]

    Heads up, everybody, there's yet another one making the rounds, named
ResumeWorm, or W97M.Resume.A, so keep an eye out for this one.
    It's very destructive, but is easily detectable. Fortunately, since this
one is business oriented, it kind of stands out when it comes in to a home
PC. It has been cropping up more often in the last week or so, as it leaves
the business world via peoples address books, so I'm giving you this heads
up.
    The virus will have the subject line: "Resume - Janet Simons", and will
contain an attachment that will be titled any one of the following
"RESUME1.DOC", "Explorer.doc", or "NORMAL.DOT".
    The  body of the text will contain the following:

To: Director of Sales/Marketing,

Attached is my resume with a list of
references contained within. Please
feel free to call or email me if you
have any further questions regarding
my experience. I am looking forward
to hearing from you.

Sincerely,

Janet Simons.

    DO NOT OPEN THIS ONE. If you see that subject line, delete it
immediately. Since you're (well, most of you, anyway) not looking for
resumes in your inbox, it should be pretty noticeable.
     If you open it, the following will happen -it will first mail itself to
everyone in your address book, and also creates 2 copies of itself on your
hard disk. One is created as

C:\Data\Normal.dot, and the other is created as:

C:\WINDOWS\Start Menu\Programs\StartUp\Explorer.doc.

    It will then attempt to delete the following files:
C:\*.*
C:\My Documents\*.*
C:\WINDOWS\*.*
C:\WINDOWS\SYSTEM\*.*
C:\WINNT\*.*
C:\WINNT\SYSTEM32\*.*
Also A-Z:\*.*

    In short, it tries to wipe out everything on every drive on your system.
It's possible to recover from this one, but it's a royal pain in the ass. If
you can recover the files, the worm can be removed by simply deleting the
two files listed above.

    Sieggy