warning hotmail users

hello ppl
this is a warning to any 1 using hotmail there is a growing number of virii spreading through hotmail at the moment and mcafee isnt picking it up as virii. today some 1 tried to infect me with the W32/duni.worm.c and some other virus i dowloaded in an attachment email is labeled facturas <-- i have had 3 of those in the past 8 days and mcafee failed to recognise any of them i cant open NAV to see what the other virii is im getting the error message norton intgrator could not initalize the current frame class please make sure you didnt directly run the integrator ? if i get it opeed i will postthe other ame of the virri i thik it is self extracting because i didt open it and NAV caught it when the download completed so heads up ppl using hotmail

Thnx prodikal for good reading here. Maybe it's not too late. :)

Never used such big free email providers and never got virii from e-mail. :cool:

i have just contacted mcafee but i just recieved an email from them saying they will take it in to considoration within 48 hours who knows how far these virii have spread allready and 48 hours is a lot who know`s how may people will end up infected by then

yeah they been out since a while now just update your IV and you be ok to know what is the virus the file that they would send you is .CPL and is mostly stuff in spanish, I have norton anti virus 2002 and it detected it so thats good!


this is what some of the files that they send you would say:

Esta SI que it zorra!!!
Photo de asesinatos, Jack el Destripador, Charles Manson, y muchos mas para decorar do escritorio.
Yeahhh Mutha Facka... NY Brookling in your NET.
Genera password para more poder entrar A read webs mas putonas de la talks, y free of charge, incluso podras bajar peliculas porno.
Para loosely verdaderos amigos...
Test de amor.
30 pregutas para saber SI do pareja width unit enga
!La de cristo EN imagen un bosque.
mira como seria un mundial EN la antigua mesopotamia.
Photo de Cristo para decorar do escritorio.
Width unit han enviado una pos valley.
Width unit acuerdas de mi?
Asi SE hace el amor...
Asi ME gusta A mi...
Esto doleria mucho, mucho: -).
SI esto NO ME lo regresas ME sentire times.
La vida despues de la muerte.
ME cambie de correo, aver SI ahora ME of escribes...
Leelo y reenvialo A of quienes mas amas.
Cancion de amor, para ti.
Paulina Rubio y CSU zorrita cosmica...
NO todo lo que UN lea sobre el servicio de webmail de Microsoft it cierto.
more!Ver el listado de falsas alarmas.
!ja, la han cagado con video este.
Are shop DT de la seleccion de arabia...
Are shop nuevo goliador de Arabia saudita, jaaaaaaa.
Are shop presidente de la FIFA.
Dime que width unit parece esta animacion.
Una broma para read secretarias.
Test para secretarias, para more saber que tan tontas son.
41 preguntas para saber SI alguien it sicopata.
mira esto it mas ordinario que gato con hanta, juaaaaaaaaaaaa.
listado de ultimas mentiras que circulan por loosely mails.
Load of hoaxes cunning.
como width unit gustarian este par de tetitas.
Leelo y reenvialo A of quienes mas amas.
mira esto it mas ordinario que gato con hanta, juaaaaaaaaaaaa.
listado de ultimas mentiras que circulan por loosely mails.
Are shop killing muthaFaka Bill Gates.

The name of the Attachments is selected from the following list:

zorrita.cpl
jack.cpl
sickofitall.cpl
analpasswords.cpl
poema_angelical.cpl
testdeamor.cpl
Adulterio_en_tus_narices.cpl
Cristo.cpl
mundial.cpl
cristo2002.cpl
postal_de_mi_alma.cpl
estesoyyo.cpl
milposiciones.cpl
como_como.cpl
por_ahi_noooooo.cpl
lomasimportante.cpl
vidaymuerte.cpl
[email protected]
milvidas.cpl
comoolvidarte.cpl
paulinasex.cpl
mentiras_en_hotmail.cpl
listado_de_hoaxes.cpl
zapato_en_el_culo.cpl
binladenDT.cpl
gooooooool.cpl
Fifaladen.cpl
secretarias.cpl
test_secretontas.cpl
sere_yo_uno_de_esos.cpl
scarycrai.cpl
mentiras_mails.cpl
mcaffehoaxlist.cpl
tetris2002.cpl
zandias_meloones.cpl
quien_como_tu.cpl
portymore.cpl
listado_de_porquerias.cpl
billgatesscream.cpl

The worm looks with the help of the server mail.hotmail.com for addresses in the contact list of MSN of measuringclose, to which it sends itself then.

In addition W32/Duni-A tries to spread over the KaZaA Peer ton Peer network. The worm copies itself into the KaZaA Download range of the user with one of the following file names:

DivResidentEvil.ZIP.cpl
SpidermanDesktop.cpl
Porno_sTar.cpl
AXEbahia.cpl
NuevosVideosProfesorRossa.cpl
NewVideo_Blink182.cpl
LagWagon&Blink182.cpl
Hacking.cpl
AllMcAfeeCrack.Cpl
Britney_spearsVSDavidBeckham_AnalPasions.cpl
JamieThomasVSrodneyMullen.cpl
MariguanaDesktop.cpl
AgeOfEmpires2_Crack.cpl
Mames.Zip.cpl
terminator2.cpl
Binladen****inBillGates.cpl
AnalPasswords.cpl
ElvisDesktop.cpl
AVP_Spanish.cpl
ZoneAlarmCrack.cpl
HardXCore.cpl
PhotoShop6.xCrack.cpl
BioHazard.cpl
VisualBasic.Net.cpl
Zidane.Taliban.cpl
VideoPortoSeguro.cpl
sexo_en_la_calle.cpl
sexo_anal_full_video.cpl
sexo_oriental_full_video.cpl
muertes_videos.cpl

If the worm is started, it provides copies of itself in the root file and in the Windows file. These copies have names, which consist of a coincidental number and the extension CPL. The worm adds thereupon the following registration entry in addition, so that the copy in the Windows file is activated with each start by Windows:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

W32/Duni-A tries to disturb anti-virus software by deleting the following files: C:\archiv~1\perav\pav.dll, C:\archiv~1\perav\per.dll, C:\Programme\perav\pav.dll and C:\Programme\perav\per.dll as well as the files PAV.EXE, \bases\avp.set, \system\vshield.vxd, \system32\vshield.vxd and \vshield.vxd from the Windows file.

In addition it changes the following registration entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Pav.exe
HKLM\Software\KasperskyLab\SharedFiles\Folder.

lildragon that facturas virii is in spanish and the other one is in english the attatcments are called
facturas556.XLS.pif and the other one is labeled list.txt.by.microsoft.com

well that one is running in hotmail also

there are quite a lot im going to go through the deleted items to see what else comes up i will keep u updated

ok thanks, yeah the spanish ones ive been getting in hotmail I dont know why mcfee in hotmail doesnt tell you is a worm!? Thats something mcfee and hotmail are going to have to fix. Because alot of people are starting to learn how to use the internet and emails and that virus would get them if they dont know what are they doing.

bah i deleted the other emails with attatchments but i will post the email mcafee sends how they are coping with the problem if it is fixed etc

Thanks for the heads up....I've never been overly impressed with MacAfee anyway.

this was the problem i had, thanx for your help people the other day. this is a nasty bugger i only downloaded the attachment because maccrappiefee did not detect it, only norton on my system after. the file is 313 kbs in size and there is another 316kbs in size..

99

Don't trust anyone. Use text only email. Make sure windows is set to view full extentions. If you don't know who it is delete it. Don't put your real email address in places where people can get it. Don't accept files from users you don't know over irc or go to links recomended by someone especially if they don't have a real nick, ignore whatever they tell you. And lastly Don't trust anyone.

I get atleast one virus and espeacially hoaxes every April 1st. Normaly this date is a very funny & fun time but unfortunetly keeping up with what your AV's needs is no joke so If it looks strange to you then chances are you should just get rid of all weird e-mails.

PS. it also helps not to openly give your e-mail out. If you come to a site that asks for a email address then simply type [email protected] you would be suprised how many times that works plus you get less spam this way.

re hotmail worm, this worm searches for msn messenger once in your system it will then send it self to all your msn contacts, thats how it is spreading. i have received several more today in spanish dirlect, some headed binlarden fcuk bill gates, other bin laden headers and also now headers including new york.

i have sent an email to the addresses that have been sending me emails informing them that i have been getting emails with this worm attached from there address.

this just shows msn hotmail does not give a toss about it clients, it should update its antivirus software? to protect its customers. as if i am gonna pay $19 a year to have a bigger account with them.... express your opion and send msn support a nasty email telling them what you feel about there services!!!!!!!!!!!!!!!!

99

Thanks for the newz......... hope that MacAfee can do somthing about that ........

What does .CPL stand for any way?

pretty much.. I stopped using MacAfee a LONG time ago.. it seems that their updates are really far behind all other companies :rolleyes: Thx for the heads up prodikal

hollow man: .cpl is the extension for control panel settings.

eg, main.cpl where you can set the mouse properties.

Yeah I think to whole idea about mc caffe sucks. With my inside information they say they
have fixed the problem though i haven't tried it.
I really like mc caffe till now .Anyway, **** it.

lets also not forget about Klez.E and Klez.H, which are stull hugely prevalent on MSN Hotmail for some reason. More information about the virus http://[email protected]

Got seven of them this week, and over 50 this last month.

A quick way to check if you're infected: open your windows\system folder and look for a file called "wink???.exe" where the ??? is two or three random letters. You can get a fix at the above URL.

guys... this worm is spreading awfully fast.... my friends have it and its been sending me trying to send me these files... since most of my friends dont know spanish i figured something was wrong with it....

thanks for the info..