For EFUSCO and others - GreenHybrid

flare · #1 (**permalink**) 11-09-2004, 09:41 PM

If you recieved an email with RE: Thank you and a message with

) and an attachment

DO NOT OPEN IT.

Evan, you have a virus and you need to get rid of it. Look in your system32 folder and see if you have the file "wingo.exe" If you do, that means you have it and its an email worm. That's how i got an email from you even when you didnt email me.

The virus is a trojan called

I-Worm/Bagle.AZ

i suggest you google it to see how to get rid of it.

-Flare

efusco · #2 (**permalink**) 11-10-2004, 08:37 AM

Don't think it's me bud! But maybe

First, I've never had a virus and take some pretty good precautions to avoid it.
Second, I checked the folder directly and don't have the wingo.exe file in there.
Third, I did a HD search for wingo.exe and it was not found.
Fourth, I did a virus scan with McAfee and the latest update. It DID find the exploit-byte verify trojan (thus making it worthwhile to do), but not the wingo. And from what I've found at The Mcafee site I don't think it's causing the problem that caused you to get the malicious e-mail.

I suspect it's someone who's got both of our e-mail addresses in thier address book and the worm is sending out e-mails from that computer tagging it with my address.

I do appreciate the info though and checking was worth while to get rid of the one I have.

flare · #3 (**permalink**) 11-12-2004, 07:32 PM

Its a good thing you dont have it!

When I looked it infected about 20-30 files

the worm is definately tagging your address. I've got another email with your address

... same subject title, same virus

Didn't open it. So i'm happy

Hot_Georgia_2004 · #4 (**permalink**) 11-12-2004, 07:52 PM

MS Windows mail programs are always attacked by these things, I guess that's the easiest way.
Personally I don't use Outlook to view my messages, I get them on a CE device and almost never open any attachments....not even from dear 'ol mom.
None of my desktops or notebooks are configured to recieve email.
I'll call the sender first and find out if they meant to send it.
If I absolutely must have the attachment then I'll copy the file over and scan it first.

It is soooooo important to keep up with all the MS patches for your OS and keep our virus definitioans up to date, as well as a good reliable firewall.

I'm glad the good folks here are on top of it.

What really bugs me are the HTML code written into some website pages that attempt to disable the program download warning built into IE.
Who would have thought that a major financial business website would try to disable the warning only to automatically download and execute some mystery program??