RE: VIRUS ALERT

[Glenn F. Henriksen]

Hello.

It is a virus and it is described at 
http://www.europe.f-secure.com/v-descs/badtrans.shtml and

http://www.symantec.com/avcenter/venc/data/w32.badtrans.13312@ style="color:#666">stripped (as
refered to in your email)

The files INETD.EXE and KERN32.EXE are not system files but have similar
names to system files.

I suggest that you follow the instructions at 
http://www.symantec.com/avcenter/venc/data/w32.badtrans.13312@ style="color:#666">stripped to
remove it, not the instructions in your email (NOTE: link may be wrapped).

I also suggest that you read http://www.f-secure.com/virus-info/hoax/.
Especially the point the emphesises that end users should not forward virus
alarms. It is the responsibility of MIS departments and certanly off-topic
on a mailing list for mySQL. The virus in question has been in the wild for
almost a month and does not warrant such attention.

This message is posted to the mySQL mailing list in the hope that it will
prevent more follow-ups. If anyone wants to discuss this matter further I
urge you to send me a personal email.

Regards,
Glenn Henriksen (glenn@stripped)

(Note: I am in no way affiliated with mySQL or the mailing list. I'm just a
regular subscriber of mailing lists.)

> -----Original Message-----
> From: Chris [mailto:chris@stripped]
> Sent: Tuesday, June 05, 2001 2:05 PM
> To: win32@stripped; Oliver Richman
> Subject: Re: VIRUS ALERT
> 
> 
> WARNING COULD BE HOAX,
> I have also received instructions to delete an .exe file 
> from another message group but
> on checking with local university it was a hoax and the 
> file in question was a needed windows system file and IF 
> it had been deleted it would have caused serious 
> problems. PLEASE, anyone reading this message below make 
> up your own mind and check with someone who is 
> knowledgable about these things before being silly and 
> deleting ANYTHING.
> There are a lot of sick people about.
> 
> Regards,
> Chris
> ---------
> 
> Quoting Oliver Richman <frl8@stripped>:
> 
> > Dear Sir or Madam;
> >
> > I have detected that a user on eBay has sent me a 
> RELATIVELY BENIGN
> > computer
> > virus.
> >
> > If you opened the attachment in one of the previous 
> e-mails I sent to you,
> > you have become infected with this virus.
> >
> > HOW TO DISINFECT:
> >
> > 1. Start your computer in SAFE MODE.
> > 2. DELETE the file "c:\windows\inetd.exe"
> > 3. DELETE the file "c:\windows\system\kern32.exe"
> > 4. EDIT "c:\windows\win.ini" and REMOVE any lines 
> which reference the above
> > two files.
> >
> > PLEASE SEE THE NORTON ANTIVIRUS WEBSITE AT
> >
> > 
> http://www.symantec.com/avcenter/venc/data/w32.badtrans.
> 13312@stripped
> >
> > FOR DETAILED VIRUS INFORMATION AND DETAILED REMOVAL 
> INSTRUCTIONS.
> >
> > Thank you, and I am sorry that I accidentally sent you 
> a virus.
> >
> > -Oliver Richman
> > ----- Original Message -----
> > From: "Chris" <chris@stripped>
> > To: "Rene Tegel" <tegel@stripped>; 
> <win32@stripped>
> > Sent: Sunday, May 06, 2001 10:00 AM
> > Subject: Re: Mysql-ok,Apache-oh,Php-Hmmmmmmmm
> >
> >
> > > Quoting Rene Tegel <tegel@stripped>:
> > >
> > > > Chris,
> > > >
> > > > why don't you uninstall apache and php and every 
> trace
> > > of it, and begin all
> > > > over again following exactly details as described 
> in
> > > the php manual...
> > > >
> > > > btw: the subject is beginning to be a bit 
> off-topic...
> > > :)
> > > >
> > > > gl
> > > >
> > > > rene
> > > ----
> > >
> > > sorry
> > > bye
> > > Chris
> > >
> > > 
> --------------------------------------------------------
> -------------
> > > Please check 
> "http://www.mysql.com/Manual_chapter/manual_toc.html" 
> before
> > > posting. To request this thread, e-mail 
> win32-thread5971@stripped
> > >
> > > To unsubscribe, send a message to the address shown 
> in the
> > > List-Unsubscribe header of this message. If you 
> cannot see it,
> > > e-mail win32-unsubscribe@stripped instead.
> > >
> >
> > 
> 
> ---------------------------------------------------------------------
> Please check 
> "http://www.mysql.com/Manual_chapter/manual_toc.html" before
> posting. To request this thread, e-mail 
> win32-thread6340@stripped
> 
> To unsubscribe, send a message to the address shown in the
> List-Unsubscribe header of this message. If you cannot see it,
> e-mail win32-unsubscribe@stripped instead.
>