Microsoft Outlook and the 'Hi' message screen saver program

December 4, 2001 | WIMom

[WIMom]

Has anyone received this message via Microsoft Outlook? If it is opened, it regenerates and copies people in your address book. I am not including the .scr file because I do not know the ramifications associated with this file. I know, I don't use Microsoft Outlook at home, but at work it is our only option. If anyone has additional information regarding this latest mess with Microsoft Outlook, please post your information. Thanks.......

---

Subject: Hi

Text of message:

How are you ?
When I saw this screen saver, I immediately thought about you

[gone.scr] screen saver file,
dark blue image of Darth Vader
with light blue background

I am in a harry, I promise you will love it!

[NativeNewYorker]

Standard Outlook address book exploit: Sends copies of itself to everyone in your email list.

It may do more, but that's all I know.

[Dog Gone]

I received this company email a few minutes ago:

To All Users

Subject : VIRUS WARNING - W32.Goner worm

We have been notified of a new global virus incident that you need to be aware of that a number of internal users have already executed.

What does it look like ?

The message being distributed has a subject header of 'Hi' and an included file attachment called 'GONE.SCR'

The message body is :

How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!

What does it do ?

If executed this infected file attachment runs a script and mails itself to other users from your address book and it would then attempt to delete a number of executable program files on your PC including virus protection software.

What do you need to do ?

If you receive this message - please ensure you DELETE THE MESSAGE without accessing the file attachment. If you have viewed this message in preview pane there is no problem so long as the file attachment has not been opened.

[japaneseghost]

The following was an email I received about an hour ago from my work's IST dept.:

We have been made aware of another software virus making its way through the Internet. The email contains the following information:

Subject - Hi
Attachment – Gone.scr

Message – How are you ? When I saw this screen saver, I immediately thought about you. I am in a harry, I promise you will love it!

This is a good time to check your virus definitions by clicking the Norton’s anti-virus software icon in the lower right-hand side of your monitor (with the Red Cross on it) and verify that you have a virus definition date of 12/04/01 or later. If you find your virus definition date is prior to 12/04/01, please click on the “live update” icon to download the latest virus definitions.

If you receive an email with this subject line or attachment, do not open the attachment and let the Help Desk know immediately.

Our new email server software (Mime Sweeper) is programmed to identify and delete any messages with the above mentioned attachment and subject line. We would also like to remind you that Internet email accounts (e.g., Hotmail/Pop3/MSN mail/AOL/Yahoo mail,etc…) outside of XXXX's internal Microsoft Outlook system are at risk to viruses such as these. If you access such Internet email accounts from a Firm PC, please exercise due care and only open attachments to such messages with caution.

Emails similar to this one will be sent by IS/T each time a known destructive software virus is making its rounds though the Internet. The intent of the email is to keep everyone informed of these issues, and hopefully, enable you to take the necessary precautions for home PCs or the like.

Thank you.

http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm.html

[the_Watchman]

If you have to run MS Outlook, then at least don't use the preview mode. The preview window opens the mail and potentially activates some of the virus code.

[WIMom]

I knew I could get FReepers advice! We are a very small company and we manage our own computers as needed. You all are awesome! Thanks!!!!!!!!

[okie_tech]

Well a .scr is a screen saver file. But really what of it? It's one of a million outlook viruses out there that replicate by using your address book. If your virus scanner didn't catch it then most likely IT is not doing their jobs. If you don't have any IT staff then tough titties. I'm looking for work right now and don't want to hear about and I'm tired of hearing people whine about their computer problems because they won't do anything about it.

[WIMom]

Thank-you!

[WIMom]

Thanks, I never do. It's bad enough I have to use it here.....

[WIMom]

No wonder you don't have a job with that attitude. Good luck finding one.

[okie_tech]

And here's one more rant. If you don't know who it came from or you don't know what it is or you weren't expecting it in any way or it says I love you and it's from your friend Bob (and your name is Joe) and your pretty d@mn sure that Darth Vader screen savers aren't required to do your business then

DON'T OPEN THE GOD D@MN THING!!!!!

[Mr. Bird]

Heh, heh, my thoughts exactly. Just a question, though, from your typical business user of computers: Will we ever get to the point where people will understand the idea of NOT OPENING ATTACHMENTS on emails of unknown origin? Was there a particular date that people no longer had to be reminded to remove their hands from the garbage disposal before turning it on? Does anyone here want to admit to being retarded enough to actually tempt fate like this?

[JohnGalt]

http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_GONE.A&VSect=T

[WIMom]

Duh, I didn't open it, and I love you to. Now go away.

[toupsie]

I can safely open any attachment sent to me. Oh, that's right, I use a Mac.

Once again, another virus/trojan alert on Free Republic because a conservative is 'too cheap' to buy a Mac...

[Roebucks]

Am I correct that on another thread you stated you are a Linux user? If so, I have a question for you.

[WIMom]

Probably not. I just inquired to have additional background information. Almost everyone on this thread has been helpful and I really appreciate it.

[Roebucks]

because a conservative is 'too cheap' to buy a Mac...

If you bothered to read the thread, you'd notice that WIMom stated she was at work in her small office. Your comment assumes so much that it makes a complete @ss of you.

[WIMom]

We do have Mac's here for our graphics department. Most companies are given 'sweet' deals for installing PC's and MS products. Then MS 'upgrades' every year or so. It'll be nice to see more Linux type applications in the future......

[WIMom]

I'm not, but my husband has it running on one of our computers. If you ask, I can forward your question to him and he may be able to help...... He's a lurker.....