Discussion Locked

Worm alert

0 helpful
6 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
top of address book has 1000 listed as name, and in the individual record "worm alert" in the screen name. Have I been invaded, and how do you recommend getting rid of it?

6 replies

by gigelul

First of all: if you are in an network disconnect it (remove the patch cord from your NIC card and contact your network administrator).
If you don't work in a network give us more detail about OS, app used, etc.
Some options:
-don't try to run/open again suspect messages, delete all unknow e-mails, purge deleted items, close all applications.
-on other clean computer with the same OS make a boot diskette copy fdisk.exe and sys.com.
-change in BIOS boot sequence to A,... and boot your system from diskette
-run fdisk /mbr and power off computer
-power on computer and boot normal from HDD.
-install an updated antivirus and check your systems.
Depends of virus this steps is possible do not clean your system.
If you don't have important data you can erase with fdisk all your HDD and reinstall it again (follow previous described steps).

by ksmith5770

Florinel as requested following: OS is Windows ME, app used is visor palm software routed through MS Outlook.

by timwalsh

You have not been invaded by a worm. This address record was probably put there on purpose by your email administrator.

I have seen these types of listings used 2 ways (both using the way worms function to the advantage of your organization (hopefully)):
1. The record points to a non-existant email account. When a worm launches and starts sending bogus mail to everyone in your address book, it will hit the addressee "1000" first (it's the first on the list). At the very least a bounce message will immediately be sent to whichever user triggered the worm and notifying that person of what happened (hopefully so they can take immediate action to prevent further spread of the worm. Sometimes (depending on the design of the worm), if aworm hits a bogus or non-existant address, it will cease to function, thus stopping the spread.
2. Sometimes an administrator will have this address record pointing to a live email account (like his), so that someone knowledgable can take immediateaction and possibly halt the further spread of the worm.

This discussion is closed to new replies.