] [Thread Prev
Fw: [ VIRUS WARNING ] - Worm/Gibe - 03/12/2002
- To: "Yann Geron" <email@example.com>, firstname.lastname@example.org, "Wolf, Bill" <email@example.com>, "William Mcallister" <BILLYBUDDHA@webtv.net>, "Wayne Krantz" <firstname.lastname@example.org>, "Tony & Sid" <email@example.com>, "Tommy Curran" <firstname.lastname@example.org>, "Todd Klein" <email@example.com>, "Tina Jänicke" <firstname.lastname@example.org>, "The Virg" <email@example.com>, "The Grockis" <firstname.lastname@example.org>, "Tamburro, Vincenzo" <email@example.com>, "Susan Durfee" <firstname.lastname@example.org>, email@example.com, "Steve Greenfield" <firstname.lastname@example.org>, "Steve Durels" <email@example.com>, "STEPHAN Metzger" <firstname.lastname@example.org>, "Stephan Metzger" <email@example.com>, "Stanley Pinska" <firstname.lastname@example.org>, "Sean Portnoy" <email@example.com>, "Scott Rees" <firstname.lastname@example.org>, "Scott Lewis" <email@example.com>, "Russ Zack" <firstname.lastname@example.org>, "Robert Oliver" <email@example.com>, "Rick Walker (loop.pool)" <GLOBAL@cruzio.com>, "René G. Ceballos" <firstname.lastname@example.org>, Reaktoremail@example.com, "Proof 151" <firstname.lastname@example.org>, email@example.com, "Phil Marino" <firstname.lastname@example.org>, "Peter Acker" <email@example.com>, "Paul Fraser" <firstname.lastname@example.org>, "Patrick O'Donnell" <email@example.com>, "Nontecbabe" <Nontecbabe@aol.com>, "Nikki Santucci" <Nikki@geronlaw.com>, "Neil Kessner" <firstname.lastname@example.org>, "Neil Doherty" <email@example.com>, firstname.lastname@example.org, email@example.com, firstname.lastname@example.org, "Mike Zaccaro" <email@example.com>, "Mike Levy" <MFLDVP@aol.com>, "Midge Nutman" <MNUTMAN@rosscohen.com>, "Michael Reynolds" <firstname.lastname@example.org>, "Michael Rao" <email@example.com>, "Michael Levy" <firstname.lastname@example.org>, "Michael LaMeyer" <email@example.com>, "Michael L. Pearson" <firstname.lastname@example.org>, email@example.com, "Matt Swenson" <firstname.lastname@example.org>, "Mary & Mike Lemoult" <email@example.com>, "Mario De Ciutiis" <firstname.lastname@example.org>, "Marcy Kaye" <email@example.com>, Madlove70@aol.com, LWawrzinek@aol.com, "Luis Bravo" <firstname.lastname@example.org>, "Lori Skjeveland" <Lori.A.Skjeveland@usa.xerox.com>, Loopers-Delight@loopers-delight.com, "Lisette Rodriguez" <Lissette@rhcrlaw.com>, "Lind, Jeffrey" <email@example.com>, "Lee Hopp" <Playbacksi@hotmail.com>, firstname.lastname@example.org, "Layne S. Frank" <email@example.com>, "Layne S Frank" <firstname.lastname@example.org>, "Lacardullo" <email@example.com>, "Kris Sookraj" <firstname.lastname@example.org>, "Koerner, Jonathan \[FI\]" <email@example.com>, "KEYS Cummings" <firstname.lastname@example.org>, "Kenny Lozano" <email@example.com>, "Kenneth Roko" <Kroko@superstructures.com>, "Ken Bob Skjeveland" <firstname.lastname@example.org>, "Kelly Chan" <email@example.com>, "Keith Cody" <firstname.lastname@example.org>, "Katrina Cockerham" <email@example.com>, "Karl Andren" <firstname.lastname@example.org>, "Karen Savage Goldman" <email@example.com>, "Julie Condy" <firstname.lastname@example.org>, "Josh Sinel" <email@example.com>, "Josh Goldman (E-mail)" <firstname.lastname@example.org>, "Josephine Ng" <email@example.com>, "JONNAMC" <JONNAMC@aol.com>, "John Margaritis" <firstname.lastname@example.org>, "John Kosa" <email@example.com>, "John Koerner" <firstname.lastname@example.org>, "John Kelly" <JKelly6045@aol.com>, "John Holston" <email@example.com>, "John Cahill" <firstname.lastname@example.org>, email@example.com, "Joanne S. Fryer" <Jsf22@aol.com>, firstname.lastname@example.org, JGregg8877@aol.com, "Jessica" <email@example.com>, "Jeremy Bier" <firstname.lastname@example.org>, "Jeff Reich" <email@example.com>, "JComp" <JComp@G2X.COM>, "Jason Sawyer (Electrix)" <firstname.lastname@example.org>, "Jane Porges" <email@example.com>, "Jack Heffernan" <Jackheff@aol.com>, "ira adler" <firstname.lastname@example.org>, email@example.com, "IK Multimedia Tech Support Staff" <firstname.lastname@example.org>, HarryEsq@aol.com, "Gregg Z. Bonura" <email@example.com>, "Gregg Winter" <firstname.lastname@example.org>, "Gregg Schenker" <email@example.com>, "Gregg Saver" <firstname.lastname@example.org>, "Greg Bonura" <email@example.com>, "Gordon Tapper" <firstname.lastname@example.org>, GMSDRUM@aol.com, "George Martel" <email@example.com>, firstname.lastname@example.org, "Frank Haines" <email@example.com>, FOREDRUMN@aol.com, "Firinn Taisdeal" <firstname.lastname@example.org>, email@example.com, "Erica Briggs" <firstname.lastname@example.org>, "Eric Reinken" <Reinken@erols.com>, "Eric Hirsch" <EHirsch@murrayhill.com>, email@example.com, firstname.lastname@example.org, "Doug Jones" <email@example.com>, "Doug Goldblatt" <firstname.lastname@example.org>, "Devine, Connie \[BUC/Danbury\]" <CDevine@bransonultrasonics.com>, "DeLucia, Darrin" <ddelucia@TULLIB.COM>, "DeBonis, Marie K. N." <MKNDeBonis@bingham.com>, "David J Ellis" <DavidEllis@aol.com>, "Dave Kanbar" <email@example.com>, "Dave & Robin Klein" <Willsjake@aol.com>, "Daniel Ash (work)" <firstname.lastname@example.org>, "Daniel Ash (home)" <email@example.com>, "Dan Oglevee" <firstname.lastname@example.org>, "Customer Service Email Team - Ohio" <CServeOH@kable.com>, "Customer Service" <email@example.com>, "Cubase Customer Support" <firstname.lastname@example.org>, "Cousin Nancy Alligood-Ellis" <email@example.com>, "Cornelius Curry" <firstname.lastname@example.org>, "Connie Rossi" <email@example.com>, "Clifford@BienAppraisers" <firstname.lastname@example.org>, "Cheryl Medford" <email@example.com>, "Cecile P Tucci" <firstname.lastname@example.org>, CCarlson@bransonultrasonics.com, "Carol Lynn Smith" <email@example.com>, Bvila@aol.com, "Bruce Bronson" <firstname.lastname@example.org>, "Brian Smalley" <email@example.com>, "Brian Cummings" <Brian_Cummings@yahoo.com>, "Bobby DEAL Seidenberg" <MRBLUE1111@aol.com>, "Bobby Boy Cummings" <firstname.lastname@example.org>, email@example.com, "Bob Tolve" <firstname.lastname@example.org>, "Bob (home e mail) Cummings" <email@example.com>, firstname.lastname@example.org, "Bill Cummings" <email@example.com>, "Bill Cummings" <firstname.lastname@example.org>, "Bennett Killmer" <email@example.com>, firstname.lastname@example.org, "Barbara Gregory" <email@example.com>, "Barbara Eisenstadt" <Beisenstadt@murrayhill.com>, "Barbara Edelman" <firstname.lastname@example.org>, "Artie Shear" <email@example.com>, "AMY" <firstname.lastname@example.org>, "Aldo Mazza" <email@example.com>, firstname.lastname@example.org, "Adam Lauzar" <email@example.com>
- From: firstname.lastname@example.org
- Subject: Fw: [ VIRUS WARNING ] - Worm/Gibe - 03/12/2002
- Date: Tue, 12 Mar 2002 12:20:22 -0600
URGENT, Don't open this attachment if you get it. It is a virus disguised
a Security Update from MICROSOFT. I received it 3X this morning 3/12/02. It
ISW NOT A LEGITIMATE SECURITY UPDATE FROM MICROSOFT. Do not open and run
attachment. Delete the e-mail and all of it's contents. Thank you for
Worm/Gibe is an Internet worm that attempts to spread through e-mail by
using addresses it collects in the Microsoft Outlook Address Book. It
disguises itself as a legitimate Microsoft Security Update.
----- Original Message -----
From: "Central Command News" <email@example.com>
Sent: Tuesday, March 12, 2002 7:19 AM
Subject: [ VIRUS WARNING ] - Worm/Gibe - 03/12/2002
> CENTRALCOMMAND.COM Newsletter
> Without us, there's no defense.T
> You are receiving this news letter because you are a subscriber
> to the Central Command News mailing list.
> **| DON'T WAIT TO BE A VIRUS VICTIM! |**
> Another virus outbreak can happen anytime! Don't wait to be a
> victim of a computer virus attack, get Vexira Antivirus today.
> Vexira Antivirus starts at only $49.95! Buy now:
> Central Command is issuing a VIRUS WARNING for Worm/Gibe due to
> increased virus reports to our technical support department.
> Central Command discovered this Internet worm on March 4, 2002
> and Vexira Antivirus has been updated to detect and stop this
> Internet worm.
> Name: Worm/Gibe
> Alias: Win32.Gibe@mm
> Type: Internet Worm
> Discovered: 04-03-2002
> Size: ~122.9KB
> ITW: Yes
> Worm/Gibe is an Internet worm that attempts to spread through
> e-mail by using addresses it collects in the Microsoft Outlook
> Address Book. It disguises itself as a legitimate Microsoft
> Security Update.
> The worm would arrive through e-mail in the following format:
> Subject: Internet Security Update
> Body: Microsoft Customer,
> this is the latest version of security update, the update which
> eliminates all known security vulnerabilities affecting Internet
> Explorer and MS Outlook/Express as well as six new
> vulnerabilities, and is discussed in Microsoft Security Bulletin
> MS02-005. Install now to protect your computer from these
> vulnerabilities, the most serious of which could allow an
> attacker to run code on your computer.
> Description of several well-know vulnerabilities:
> - "Incorrect MIME Header Can Cause IE to Execute E-mail
> Attachment" vulnerability. If a malicious user sends an affected
> HTML e-mail or hosts an affected e-mail on a Web site, and a user
> opens the e-mail or visits the Web site, Internet Explorer
> automatically runs the executable on the user's computer.
> - A vulnerability that could allow an unauthorized user to learn
> the location of cached content on your computer. This could
> enable the unauthorized user to launch compiled HTML Help (.chm)
> files that contain shortcuts to executables, thereby enabling the
> unauthorized user to run the executables on your computer.
> - A new variant of the "Frame Domain Verification" vulnerability
> could enable a malicious Web site operator to open two browser
> windows, one in the Website's domain and the other on your local
> file system, and to pass information from your computer to the
> Web site.
> - CLSID extension vulnerability. Attachments which end with a
> CLSID file extension do not show the actual full extension of the
> file when saved and viewed with Windows Explorer. This allows
> dangerous file types to look as though they are simple, harmless
> files - such as JPG or WAV files - that do not need to be
> System requirements:
> Versions of Windows no earlier than Windows 95.
> This update applies to:
> Versions of Internet Explorer no earlier than 4.01
> Versions of MS Outlook no earlier than 8.00
> Versions of MS Outlook Express no earlier than 4.01
> How to install:
> Run attached file q216309.exe
> How to use:
> You don't need to do anything after installing this item.
> For more information about these issues, read Microsoft Security
> Bulletin MS02-005, or visit link below....
> If you have some questions about this article contact us at
> Thank you for using Microsoft products.
> With friendly greetings,
> MS Internet Security Center.
> Attachment: q216309.exe
> Read a full virus description by clicking the link below:
> [ Subscription information ]
> Central Command, Inc. respects your online privacy. You at anytime
> can easily remove your e-mail address from the Central Command mailing
> list by entering in your e-mail address at the following web page:
> You will receive a confirmation message about your successful
> removal from News.
> [ Legal Notice and Disclaimer ]
> THIS DOCUMENT IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY.
> Disclaimer of warranties and limitation of liability
> This information is provided by Central Command, Inc. on an "AS IS"
> and "AS AVAILABLE" basis. Central Command, Inc. makes no
> representations or warranties of any kind, express or implied, as to
> the information, content, materials, or products included, or
> mentioned within this information bulletin. You expressly agree that
> your use of this information is at your sole risk. The user assumes
> the entire risk as to the accuracy and the use of this document.
> To the full extent permissible by applicable law, Central Command,
> Inc. disclaims all warranties, express or implied, including, but
> not limited to, implied warranties of merchantability and fitness
> for a particular purpose and freedom from infringement. Central
> Command, Inc. does not warrant that this information is accurate.
> Central Command, Inc. will not be liable for any damages of any kind
> arising from the use of this information, including, but not limited
> to direct, indirect, incidental, punitive, and consequential
> Certain state laws do not allow limitations on implied warranties or
> the exclusion or limitation of certain damages. if these laws apply
> to you, some or all of the above disclaimers, exclusions, or
> limitations may not apply to you, and you might have additional
> [ Copyrights and Trademarks ]
> Central Command, PerfectSupport, EVRT, Emergency Virus Response
> Team, Virus Protection for the Real World, Without us, there's no
> defense. are trademarks of Central Command Inc. All other
> trademarks, trade name and product names are property of their
> respective owners. Copyright © 2000, 2001, 2002 Central Command
> Inc. All rights reserved.