VIRUS ALERT - W32/NewApt.worm

["steven" <trails@jps.net>]

Hi Folks and Duncan: I just received this.

steven
----- Original Message -----
From: "McAfee.com Dispatch" <dispatch@mcafee.com>
To: <trails@jps.net>
Sent: Monday, December 20, 1999 5:06 PM
Subject: VIRUS ALERT - W32/NewApt.worm


> (((((((((((((((((( McAfee.com Dispatch )))))))))))))))))))))
>
> _______________________VIRUS ALERT__________________________
>
>
> [This message is brought to you as a subscriber to the
> McAfee.com Dispatch. To unsubscribe, please follow the
> instructions at the bottom of the page.]
>
>
> ************** VIRUS ALERT - W32/NewApt.worm ***************
>
>
> Dear McAfee.com Dispatch Subscriber:
>
>
> W32/NewApt is an email worm. AVERT has given it a risk
> assessment of Medium--On Watch.
>
> This worm arrives as an email attachment. The body of the
> email appears differently depending on whether the email
> client reads HTML. If it does, the email text looks like
> this:
>
>        http://stuart.messagemates.com/index.html
>
>     Hypercool Happy New Year 2000 funny programs and
>                       animations...
>
>    We attached our recent animation from this site in our
>                   mail ! Check it out
>
> If the email client is not HTML-capable, the message reads:
>
>   he, your lame client cant read HTML, haha. click
>   attachment to see some stunningly HOT stuff
>
> The worm is in the attachment, which has a name chosen
> randomly from the following list:
>
>   baby.exe, bboy.exe, boss.exe, casper.exe, chestburst.exe,
>   cooler1.exe, cooler3.exe, copier.exe, cupid2.exe,
>   farter.exe, fborfw.exe, goal.exe, goal1.exe, g-zilla.exe,
>   irngiant.exe, hog.exe, monica.exe, panther.exe,
>   panthr.exe, party.exe, pirate.exe, s.exe, saddam.exe,
>   theobbq.exe, video.exe.
>
> If the worm is run, the following dummy error message
> appears:
>
>   The dinamic link library giface.dll could not be found in
>   the specified path [list of directory names]
>
> Note the misspelling of the word "dynamic".
>
> If the worm detects that Outlook Express is installed, it
> will search for messages received and build a list of
> addresses. The next time Windows is booted, the worm waits
> an unspecified amount of time and then attempts to send
> itself to one of the addresses in its list, using the
> format described above.
>
> Note: If you are using McAfee Clinic, please click here to
> update Active Shield(TM).
> -> http://clinic.mcafee.com/clinic/virusscan/activeshield/start.asp
>
>
> --McAfee.com
>
>
> _______________________Virus Fixes__________________________
>
>
> Find out more about this virus. Click here to go to the
> W32/NewApt.worm Help Center.
> -> http://www.mcafee.com/viruses/newapt
>
>
> Check if your system is infected, click here to use
> VirusScan Online.
> -> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1122
>
>
> Purchase the latest copy of VirusScan, please click here.
> ->
http://store.mcafee.com/category.asp?CatID=3&CategoryLevel=1&rfr=VSCALRT
>
>
> Upgrade to the latest VirusScan. Purchase the VirusScan
> Maintenance Plan which entitles you to 12 months of
> upgrades, click here.
> ->
http://store.mcafee.com/category.asp?CatID=18&CategoryLevel=1&rfr=VRSPLN
>
>
> Download the latest DAT files, click here.
> -> http://download.mcafee.com/updates/updates.asp
>
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
> If this message has been passed on to you by a friend and
> you would like to subscribe to the
> McAfee.com Dispatch, click here.
> -> http://www.mcafee.com/subscribe/beginI.asp?s=22
>
> Unsubscribe: If you do not want receive the McAfee.com
> Dispatch in the future, click here.
> -> http://www.mcafee.com/unsubscribe
>
> This Virus Alert has been issued by the Network Associates
> Anti-Virus Emergency Response Team (AVERT). McAfee.com is a
> wholly owned subsidiary of Network Associates.
>
> Copyright 1999 McAfee.com / All Rights Reserved.
>
> ______________________________________________________________________
> This message was sent by McAfee.com using Responsys Interact.
>
> To view our permission marketing policy:
>     http://www.rsvp0.net
>
>
>


=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Ridecamp is a service of Endurance Net, http://www.endurance.net.    
Information, Policy, Disclaimer: http://www.endurance.net/RideCamp   
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=