IP: VIRUS ALERT - I strongly suggest reading the url re myths

[David Farber <farber () cis upenn edu>]

For more information on the ShareFun virus, please go to:


   http://www.kumite.com/myths/myths/myth029.htm




At 11:26 AM 3/3/97 -0800,  wrote:
> PLEASE READ THE FOLLOWING.  THIS VIRUS IS NOT A HOAX.  IF YOU GET AN
> EMAIL WITH THE SUBJECT OF :You have GOT to read this!
> DELETE THAT EMAIL WITHOUT READING IT.
>
> Confirmation from McAfee this morning that the ShareFun.A
> virus is real.  The virus will corrupt all the data on your hard drive
> (and potentially the network).
>
> Here is what they say about it:
>
> "There is a 1 in 4 chance, after the virus has infected of doing the
> following activity: First, the macro virus will save a copy of itself.
> Then it will check to see if you are running Microsoft Mail. If so, the
> virus will find 3 random people in your mail list and send a copy of the
> infected document with the following subject: You have GOT to read this!
>
> "If MSWord is launched to read this attached file, the receiver will
> become infected and above process will begin again.
>
> "Warning: If you receive a message with the following subject or banner:
> You have GOT to read this!, do not execute its attachment. Delete the
> entire message.
>
> "Do not attempt to look at the macros. Both the Tools|Macro and
> File|Templates will activate the virus. The macro FileSave is copied to
> the Global Template file NORMAL.DOT. Once this has occurred, any new
> document opened will be infected."


--- end forwarded text