Robert Francisco wrote:
>
> Lately, I have recieved an scr file. Out of curiosity I placed the file
> where the other scr's are and it showed up as one of the choices as a screen
> saver. I selected it and did a preview, nothing happened so I deleted the
> scr file. Now, I'm thinking this is a bad thing as my system seems unstable.
> I had a demo software that expired (time limited) during this time, could
> this do it too?
> I did a Norton AV and it came back clean but the def file is about a year
> old.
>
> TIA-Any help would be appreciated.
>
> Robert


Hi Robert. I had a "p0rno.scr" or something sent to me a few weeks
back, with a spanish language email. I examined the .scr file
in a hex editor and it had the MZ prefix typical of dos .exe
files. I deleted it, assuming it was a virus.

Since then I have had about 4 more emails, from a similar
sender address, but this time with "enano.exe" or something
as the attached file. Also a spanish language email and
the sending address www.se*yfun.net (*=x) Hahaha@

I went to se*yfun.net and they have a page explaining that
they are innocent victims, and telling more about this virus
sometimes called snow white. I believe that once the .scr
or .exe is run, a file is placed in your windows directory
or similar, and then when you email anyone it logs their
email address and sends them the virus later. It is not a
regular virus but is a trojan horse that may not be detected
by norton av.

More importantly, I noticed that Dan posted here he had the
same spanish virus sent to him, so it is becoming obvious
that someone on this piclist has this virus!! James help??
I have a record of the IP address of the last person who sent
it to me. Does that help?
-Roman

--
http://www.piclist.com#nomail Going offline? Don't AutoReply us!
email listserv@mitvma.mit.edu with SET PICList DIGEST in the body