BERKSHIRE-L Archives

Archiver > BERKSHIRE > 2001-07 > 0994414792


From: T J Kirk <>
Subject: NEW VIRUS!!
Date: Fri, 6 Jul 2001 11:19:52 +0100


Hello to all.I have recently been infected via an innocent lister with a
very dangerous virus.With the help of an expert in the field I am now clean
but I am forwarding the report below for your information.
Please take this very seriously.
regards
Tessa


Tessa Kirk

E-mail:


Subseven Recent Virus Attack
5 July 2001

An analysis of the system revealed an invasive code of the 'subseven' type.

The precise type is difficult to determine.

This code is especially difficult to remove or negate as it appears
to exist or to 'mutate' in various forms.

Sophos appear to have a good description of the virus at:
www.sophos.com/virusinfo/

This is a 'trojan horse' and replicates a number of key aspects on the
machine.

The removal of the virus in this case was accomplished through the
following method which may be used for many cases of unknown origin.

If funds are available visit your local computer store or download reliable
professional type antivirus software. No comment is made on the
suitability of any software but I can recommend Sophos and F-prot.

Alternatively where no funds are available check out
www.download.com

Search for 'antivirus'

Read the list of available programs. Some freeware ones are available.

Check the date of the program. Try to select the most recent from the list
as viruses are modified daily.

In this case the following program was chosen

V-Buster by Looi Hoong Thoong

This detected the 'subseven' virus

Download the program, create a new directory and place the downloaded image
in that new directory and, under Windows, double click on vbust to self
extract the files. Read the readme files and start vbuster.

I hope this helps.



This thread: