Ok, this calls for a white hat virus creator. A virus that will infect all these unpatched computers, and the only thing it does is create a big bold red popup every 15 minutes that says Patch your computer, you dummy.
John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, August 26, 2003 1:44 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Sobig, the next wave? > > > >People a typically unaware that their machine is infected - because it > >continues to function perfectly. > > That is very true. > > We infected a computer in our virus lab with Sobig.F, and you couldn't tell > anything unusual was happening. The file didn't seem to do anything when > it was run (so the recipient probably figures that the attachment didn't > get downloaded or something like that, and probably won't even say "Yes, I > ran the program" when asked by an admin), and the only noticeable > differences on the system were a couple extra registry entries and system > files (files in the \Winnt directory and \Winnt\system32 directory), and a > program running in Task Manager (something like "winsst32.exe" that doesn't > look unusual). > > People who are infected probably would have a somewhat slower Internet > connection, but that's probably about all they would notice. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
