For those of you that have outdated Virus DAT files or don’t have a Virus protection program try this link and it should help you in identifying the most recent detectable viruses and others that you might have hidden, (http://www.symantec.com/securitycheck/).

Since last Sunday evening, I have received 17 e-mails with this virus which is fairly easy to identify since the e-mail account comes with a "_" attached in front of the account, (i.e. "_THEDOCTORSW" instead of "THEDOCTORSW".

Technical Description:

This worm arrives as an email with one of several attachment names and a combination of two appended extensions.

The list of possible file names is: HUMOR DOCS S3MSONG ME_NUDE CARD SEARCHURL YOU_ARE_FAT! NEWS_DOC IMAGES PICS

The First extension that is appended to the file name is one of the following: .DOC .MP3 .ZIP

The Second extension that is appended to the file name is one of the following: .pif .scr

The resulting file name would look something like this: CARD.DOC.PIF NEWS_DOC.MP3.SCR etc.

When executed, this worm copies itself as Kernel32.exe in the "\Windows\System" directory. It then adds the following registry value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel32=Kernel32.exe.

The Link provided is an Active X application that runs interactively and will find any Viruses known and that can be detected on your Computer.

I suggest EVERYONE run this and be careful if you use Outlook and open attachments. I generally don't open attachments unless I know what they are and who is sending them to me.

Be safe,

The Good Doctor

-- Modified on 11/27/2001 10:53:17 PM