🚀 go-pugleaf

.. and it came to pass that Nick Hall <nick@vw-beetle.clara.co.uk.
SPANKYSPAM> uttered forth:
>
>My work was a mess. No internet, no mail (internal or external) and no
>file or print services. A lot of companys have quarantined themselves by
>closing all external gateways.

Mine was fine. Someone received it around 10am and forwarded
the attachment directly to me (they were running exchange client
and so couldn't run any VB stuff).

I changed it to a plain text file and read the source - to discover
that it sucks down a file (WIN-BUGFIX.EXE) from one of four
randomly-chosen websites (set as your IE start page) and so
quickly changed our proxy to deny any downloads of executables.
(squid is a *really* brilliant bit o' kit!). Following that I sent a mail
around warning people not to open any attachment like this.

Around 11pm I received two calls from customer companies
requesting assistance, as their mail servers and external links
had been taken down.

I then received four warnings about this virus (well - trojan, really)
and three further calls warning me to be on the lookout for this
virus. I repeated my advice of cutting off the proxy and scanning
areas of the registry for certain keys to all those who rang in.

Only around 5:30pm did I hear of the scale of the attack. Christ,
are there some gullible idiots out there...
-- 
 
"Dungeon" Dave, in anti-harvest mode...

From: abuse@yahoo.com
From: abuse@btinternet.com
From: *@localhost