Re: "I'm told" - Possible Email Worm?

Date view Thread view Subject view Author view

From: Steve Longenbohn (drsteve@uclink.berkeley.edu)
Date: Mon Aug 27 2001 - 10:25:15 PDT

I opened this in a text editor and looked at the hex code. While I'm no hex expert,
it appears to be a true type font that the executable "adds" to your system.
Based on the text, it is probably Psi symbols (wavy line, circle, square, star,
etc)
However, I have not run the .exe and don't recommend that you do it on anything
other than a test pc that can be formatted and reinstalled if it goes wrong.

There is nothing on either the norton virus list or the NAI virus list that
identifies this, but that's no guarantee.

On the other hand, it could be a harmless font.......????

Sara Golemon wrote:

> All-
>
> I just got a message with the subject "I'm told" and the following body:
>
> **************
> An experiment on memory, but did not disclose any more information. Their
> knowledge of the full purpose of the experiment might have affected the
> results. I then read the following script to the subject, "I'm now going to
> show you a series of five cards, each with a symbol drawn on it.
> **************
>
> which has an attached file "FONTREG.EXE". I havn't heard any official
> warnings, but this has the flavor of your typical email worm.
>
> Return-Path: <survey_list-owner@uclink4.berkeley.edu>
> Received: from uclink4.berkeley.edu (delta.ducalifornia.org
> [207.181.249.165])
> by uclink4.berkeley.edu (8.11.4/8.11.4) with SMTP id f7R2unn07373
> for <survey_list@uclink4.berkeley.edu>; Sun, 26 Aug 2001 19:56:49 -0700
> (PDT)
> Date: Sun, 26 Aug 2001 19:56:49 -0700 (PDT)
> Message-Id: <200108270256.f7R2unn07373@uclink4.berkeley.edu>
> FROM: Dylan Saloner <dylan_s@uclink4.berkeley.edu>
> SUBJECT: I told
> X-MSMail-Priority: Normal
> X-Priority: 3
> X-Mailer: Microsoft Outlook Express 4.72.3612.1700
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----=_NextPart_000_0030_01864C5A.C25C5A60"
> Content-Transfer-Encoding: 7bit
>
> ------------------------------------------------------------------------
> The following was automatically added to this message by the list server:
>
> For information about Micronet, its meetings and events, and its
> mailing list, including information on subscribing and unsubscribing,
> see the Micronet Web site at <http://wss.berkeley.edu/micronet/>. 

--
***********************************************************************
Steve "DRSTEVE" Longenbohn
University Of California
Admin. Systems: Departmental Technology Solutions (DTS)
141 University Hall, Berkeley, CA  94720-3814

voice: 510-643-9777    Cellular: 510-589-2035
fax:   510-642-3237    E-mail: drsteve@uclink.berkeley.edu
***********************************************************************

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, its meetings and events, and its
mailing list, including information on subscribing and unsubscribing,
see the Micronet Web site at <http://wss.berkeley.edu/micronet/>.

Date view Thread view Subject view Author view

This archive was generated by hypermail 2b29 : Mon Aug 27 2001 - 10:32:53 PDT