Re: correction

["Johannes Schneider" <Johannes.Schneider@xxxxxxxxxxx>]

Les Schaffer wrote:

> correction on last message:
>
> the virus comes with no Subject, and an attachment named
>
>   Sorry_about_yesterday.DOC.pif

Actually the name of the attachment can vary like this:

README.TXT.pif
I_wanna_see_YOU.TXT.pif
MATRiX_Screen_Saver.SCR
LOVE_LETTER_FOR_YOU.TXT.pif
NEW_playboy_Screen_saver.SCR
BILL_GATES_PIECE.JPG.pif
TIAZINHA.JPG.pif
FEITICEIRA_NUA.JPG.pif
Geocities_Free_sites.TXT.pif
NEW_NAPSTER_site.TXT.pif
METALLICA_SONG.MP3.pif
ANTI_CIH.EXE
INTERNET_SECURITY_FORUM.DOC.pif
ALANIS_Screen_Saver.SCR
READER_DIGEST_LETTER.TXT.pif
WIN_$100_NOW.DOC.pif
IS_LINUX_GOOD_ENOUGH!.TXT.pif
QI_TEST.EXE
AVP_Updates.EXE
SEICHO-NO-IE.EXE
YOU_are_FAT!.TXT.pif
FREE_xxx_sites.TXT.pif
I_am_sorry.DOC.pif
Me_nude.AVI.pif
Sorry_about_yesterday.DOC.pif
Protect_your_credit.HTML.pif
JIMI_HMNDRIX.MP3.pif
HANSON.SCR
FUCKING_WITH_DOGS.SCR
MATRiX_2_is_OUT.SCR
zipped_files.EXE
BLINK_182.MP3.pif

Leninist-International was hit by the MTX virus the other day. It looks as
if the Corporate Edition of Norton  Antivirus removes it. Here are the
steps:

(a) Uninstall any antivirus working on your PC and install NAV corporate
edition

(b) Insert in drive the first of 5 rescue diskettes of NAV you have
previously
prepared on a clean PC (the file go.bat must be modified by adding the
following to
the only command it contains: "> c:\list.txt"). Diskettes MUST be write
protected

(c) launch the program by booting your PC with first diskette inserted, this
will
take your PC to operate on DOS (not on Windows DOS Mode, but on DOS). Then
insert
second diskette and write the command "A:\go". This will launch a very low
level
cleanup, which may take very long.

(d) once the cleanup is over, then you look at the list.txt you have
generated.
Always on DOS!

(e) whatever file that the NAV has not fixed and is displayed as a virus
that the
program was unable to clean, you should simply delete by the good old method
of
writing "del" on the command line.

Johannes