[Groop] Re: "Hi" Virus

[Gary Grossmann]

Thanks Mark, Scott, Azamin, and everyone else for all of your help and
suggestions.

The oddest thing to me is that I cannot find any sign that my computer was
ever infected!  I've run several different scans and they all come up empty.
The only way I know I had the virus is that everyone else, including me,
received the infected message from me as a Groop member.  But it didn't
reinfect me.

So the only thing I can figure is that I got it before McAfee figured it
out, then three minutes later it sent the infected messages to everyone,
then shortly thereafter, McAfee figured it out, sent an automatic update and
cleaned out my system.

Is that possible?    -Gary G.



----- Original Message ----- 
From: "Mark Evanier" <mail at evanier.com>
To: <groop at groo.com>
Sent: Monday, January 19, 2004 12:32 PM
Subject: Re: [Groop] Re: "Hi" Virus


On Mon, 19 Jan 2004 11:26:45 -0800, "Gary Grossmann"
<grossfam at olywa.net> wrote:

>Would Mark or some other virus expert please explain to me what happened?
>
>I did not open anything.  I left my Outlook Express open overnight by
>mistake.  So the mail arrives in the middle of the night and three minutes
>after it arrived, without me doing anything, it had sent mail out to the
>Groop and lord knows who else.
>
>Then I ran a virus scan with MacAfee and it doesn't find the
>W32.Beagle.A at mm in my system.
>
>I don't get it.  I don't know what I should do.  I don't understand the
>instructions at the sight Mark gave because they don't seem to apply to
>MacAfee systems.   Please someone tell me what I need to do.  -Gary G.

ME: First off, here's the page from McAfee on this virus...

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100965

I don't know how you could have become infected since it seems like
you have to open it for it to infect you.  Perhaps you have your
Outlook Express set to do some kind of preview whereby it
automatically opens incoming messages.

I don't use Outlook Express and this is one of the reasons.  I use an
e-mail program called Agent that is so obscure that no one ever
bothers writing virus programs that utilize it to spread the virus.  I
have Outlook Express on my computer since Windows XP does not allow
you to uninstall it but I don't have to configured to send messages so
if the virus had infected me, it would just have put the outgoing
contaminated messages into OE and they would have remained there.

The virus-checking program I use is Norton, which caught the virus on
your message.  I'm not saying Norton is better than McAfee because
some day, there will probably be one it will miss that McAfee would
catch.  But my computer expert friend prefers Norton...and he used to
work for McAfee.  (I had McAfee and changed on his advice.)

I don't know why McAfee didn't catch it on yours unless your virus
definitions file is old.  When did you last download an update?  If it
was long ago, that's probably the reason.  Run an update and scan
again.

We explained all this at the Groo Panel at last year's San Diego Con.
Too bad you weren't there.
----------------------------------------------------
www.newsfromme.com (Mark Evanier's daily weblog)
www.POVonline.com (Mark Evanier's not-daily website)

_______________________________________________
Groop mailing list
Groop at groo.com
http://mailman.newdream.net/mailman/listinfo.cgi/groop