[24hoursupport] Re: Virus Scam?

  • From: "M.Thakur" <dnb_mthakur@xxxxxxxxxxxxx>
  • To: 24hoursupport@xxxxxxxxxxxxx
  • Date: Sun, 07 Sep 2003 21:42:46 +0530

I think it is a feature of the sobig worm. SoBig.F installs drops the file
winppr32.exe to the Windows directory and adds the following keys to Windows
Registry:  [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "TrayX" = %windir%\winppr32.exe /sinc
M. Thakur

----- Original Message ----- 
From: "Jim Harris" <hhlake@xxxxxxxx>
To: <24hoursupport@xxxxxxxxxxxxx>
Sent: Sunday, September 07, 2003 6:17 PM
Subject: [24hoursupport] Virus Scam?

> My sister sent the following letter. Seems like I heard something simular
a year or two ago. I told her to delete the e-mail, any advice is
appreciated...Jim Harris
> I had a virus alert in my e-mail that said i have a virus called
winppr32.exe in my system &registary keys. It said to open DOS comand promp
windows(fromStart,Programs>Accessories) and enter the following commonds
:cd"%windir%system"regsvr32/uBHO2.dll regsvr32/uMSNIE.dll  then
RestartWindows and I should be able to delete the BH02.DLL  & MSNIE,DLL
files in the system folder.(the system folder can be found in the windows
folder:It is called System 32 in XP & just System in 95 & 98. Now I wonder
who would send me such a report- I went to every thing Panda has & tried a
few other free scans. Far as I can see there is no-such virus,  but maybe
you can tell me what would happen to a persons computer if they did what
this report said to do.

For a web-based membership management utility and information on list policies, 
please see http://nibec.com/24hoursupport/

To unsubscribe, send a blank email to 24hoursupport-request@xxxxxxxxxxxxx with 
"unsubscribe" (without quotes) in the subject.

Other related posts: