PIBMUG member Karl Kasca put together this terrific virus alert. Thanks, Karl!

_________________________

At the request of one of our YahooGroup discussion list users,I'm sending

out some basic virus detection/prevention info

and a few 'Alerts'.

Obviously the BIG alert today is the 'Goner' virus:

---------------------------------------------------

First, see the latest scoop on the 'Goner' virus:

<http://www.zdnet.com/zdnn/stories/news/0,4586,5100282,00.html>

See this, re: what to look out for, like seeing 'Hi' in the subject line of

an email.

Then take a deep breath (for perspective) and see:

<http://www.vmyths.com/hoax.cfm?id=268&page=3>

However, in the last few days two discussion lists I subscribe to were hit

by two other viruses: PE_MAGISTR.B and WORM_BADTRANS.B.

The first one, 'Goner' is the worst, but the PE_MAGISTR.B can also trash

your hard drive, so it's a very bad one too.

How to find/scan for viruses:

-----------------------------

==========================================================

NOTE: if you belong to a Corporation you should check with

your IT department and follow their suggestions/procedures.

==========================================================

If you run MS Outlook/Express, it might be 'prudent' to download and run

this free evaluation program on ALL of the

email folders on your PC:

(remember to empty your 'Deleted Items' file too!)

     TrendMicro's ScanMail for Microsoft Outlook

     http://www.antivirus.com/free_tools/smo/

You should also Scan your hard drive.  You can do this for

Free by running TrendMicro's "Housecall" program while online:

    http://housecall.antivirus.com/

   (I'm recommending this, because it is sure to be updated...

   and while you may have a virus-detection software program

   you may not have updated it with the latest virus definitions,

   something that should be done at least weekly).

If you can't get to TrendMicro's website (due to web traffic/volume

or a denial-of-service attack to their website), then try

UPDATING your virus-detection program's Virus Definitions and

running it.

IF you find the PE_MAGISTR.B virus:

-----------------------------------

For more information on this virus and how to get rid of it see:

TrendMicro-Virus Encyclopedia - PE_MAGISTR.B

<http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=PE_MAGISTR.

PLEASE FOLLOW THE DIRECTIONS AT THIS SITE AND SEE THE README FILE...

"Important Note:

   If during the scanning the Trojan was detected in WIN.COM or NTLDR,

   DO NOT RESTART WINDOWS. This Trojan portion of the virus will trash

   your hard drive after you restart."

IF you FIND any OTHER virus:

----------------------------

For more information on the virus and how to get rid of it see:

TrendMicro-Virus Encyclopedia-

<http://www.antivirus.com/vinfo/virusencyclo>

Or, http://www.symantec.com/avcenter/vinfodb.html

Or, http://www.cert.org/ (currently undergoing a Denial of Service attack)

VIRUS PREVENTION

----------------

If you use MS-Outlook it may also be a good general

preventative strategy to use the program mentioned

in the following article:

PC World - 'How to Trick the Anna Worm'

   "Antivirus software helps, but a simple PC tweak can

    also protect you from VBS-based viruses."

   NOTE: the 'Goner' virus is a VBS-based virus.

Not to mention installing the Windows security updates

(at least the 'critical' ones), using:

    Start - Windows Update

And lastly, here's a free utility written by David Jung

of Pasadena IBM Users Group (PIBMUG - www.pibmug.org)

that was written to foil the SirCam worm and other malicious

code (by showing ALL of the extensions to ALL of your files:

The premise here is that if you can 'see' an additional

extension to an email attachment you will know that it

may be a virus/worm and so you won't open it, e.g.,

if you see a file name like: 'Analysis.doc.exe', the

'exe' should tip you off that it may be an executable

file and NOT the MS-WORD document 'Analysis.doc' (which

is normally what you would see without this program).

NOTE: This 'shows' ALL file AND link extensions, even

for all of your shortcuts, so if you don't like seeing

a lot of extensions, this is NOT for you!

Of course you might want a Free firewall like ZoneAlarm

http://www.zonelabs.com/zap26_za_grid.html from Zone Labs.

However, for $39.95US you can get ZoneAlarm Pro and be

protected by 'Advanced MailSafe' - E-mail attachment

protection: shields you from malicious code (for 37 file

types).  If you use ZA Pro, it 'quarantines' email

attachments with extensions that are possibly injurious

to your system (and you can adjust the settings if you

wish).

NOTE: ZoneAlarm PRO can quarantine SCR extensions (like

the one used by the 'Goner' virus).

And if you really want to cover your bases you can go to

Gibson Research Corp. <http://grc.com/default.htm>, scroll

down to Shields Up and see how protected your PC is when

you're surfing the net.  This is especially for those with

"always on" connections, e.g., Cable or DSL.

Take care & "safe" emailing and computing to all,

Karl

PS: I don't have a financial interest in any of the company's

listed here (except MS, and they seem to be the real problem,

don't they?), however I was written up in PC World as having

suffered from Software bugs, so "I feel your pain":

'PC Pest Control - Exterminate your system's bugs with this essential toolkit.'

<http://www.pcworld.com/features/article/0,aid,38888,00.asp>

"For Karl Kasca, it was the upgrade from hell. Kasca, an information

researcher in Pasadena, California, thought

installing a critical update to Windows 98 would solve a few annoying

problems he'd experienced in Word and Outlook.

Instead, bugs within the update caused countless new problems. ..."    Go

here for the rest of the story:

<http://www.pcworld.com/features/article/0,aid,38888,00.asp>

And don't miss clicking on the picture of the 'Pest'!

************************

Karl Kasca

KASCA & ASSOCIATES

Information Research -->  KASCA & ASSOCIATES finds information

mailto:kkasca@kasca.com   that Businesses and Attorneys use to

http://www.kasca.com      make actionable decisions.

(626) 795-9568  Voice

(626) 795-9569  FAX

************************

-----

_______________________________________

This E-letter may be forwarded or reproduced for non-commercial use, either in part or in its entirety, provided the following is included:

* This message is brought to you by the Pasadena IBM Users Group, an announcement-only mail list. Replies go to Steve Bass.

* To unsubscribe: mailto:pibmug-unsubscribe@yahoogroups.com

* To subscribe: mailto:pibmug-subscribe@yahoogroups.com

* Visit PIBMUG's website: http://www.pibmug.org

* Subscribe to PC World's free Steve Bass' Home Office Newsletter:

<http://www.pcworld.com/resource/newsletters/index.asp?sub_source=PCW_XB>

Copyright 2001 by Steve Bass, reprinted with permission.

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/