Vulnerability Development mailing list archives

Re: MSN Virus?


From: BRAD GRIFFIN <b.griffin () CQU EDU AU>
Date: Thu, 10 May 2001 08:59:38 +1000

This will give you a description of what you could be seeing:

Name: W32/FunnyFile-A
Aliases: W32.FunnyFiles.Worm , W32/Hello, W32/Hello.worm
Type: Win32 worm
Date: 2 May 2001

Will be detected by Sophos Anti-Virus June 2001 (3.46) or later.
A virus identity (IDE) file is available for earlier versions.

At the time of writing Sophos has not seen any infections but
has issued this advisory due to media interest caused by other
AV vendors' alerts.

Description:

W32/FunnyFile-A is a worm which uses Microsoft's MSN Messenger
program to spread. The worm only affects users who have
installed MSN Messenger programs.

If the worm is run on a system without the MSN Messenger
program, the message below is displayed:

  Run-time Error '91'.
  Object variable or With block variable not set

The worm either sends itself as a reply to a newly-arrived
message or when the user adds a new contact into the MSN
Messenger contacts list.

The body of the message contains the text:

  "i have a file for u. its real funny." .



Read the analysis at
http://www.sophos.com/virusinfo/analyses/w32funnyfilea.html

or a little here:
http://www.viruslist.com/eng/default.asp?tnews=2&nview=1&id=1074

or here:
http://vil.nai.com/vil/dispVirus.asp?virus_k=99077





-----Original Message-----
From: Niels Vaes [mailto:nielzthabeast () HOTMAIL COM]
Sent: Wednesday, May 09, 2001 4:18 AM
To: VULN-DEV () SECURITYFOCUS COM
Subject: MSN Virus?


I don't know if this has been made world-wide by Norton or MacAffee, if so,
sorry for sending this.

2 persons in my contact list wanted to send me a file with the name
"HELLO(1)(1)(1)", when I typed anything the message was immediatly replied
by my contact. When he was typing something, I didn't see his name but my
own email address: "nielzthabeast () hotmail com is typing a message". When
someone accepts te message, that person is being disconnected within the
minute.

Can anybody comment on this, or can anybody tell me how to fix this problem?

regards,

Niels Vaes
_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.


Current thread: