I know this is the MOTM list, but please bear with those of us who are
destroyed by this crap. There is a GREAT page on the cleanup at:
http://www.thepope.org/index.pl?node_id=140So far only a few instances of actual infection here, however this cleanup
procedure contained EXACTLY what we found on infected machines.
HTH
Steve
> One thing you must be careful of, even if you do remove the worm. after a
> reboot the worm will download a file from a server in the philippinescalled
> WIN-BUGFIX.EXE, this file is another worm used to collect IP and password
> data from your computer and email it back to the creator of this worm. This
> is similar but not the same as the clarissa virus, And users of Lotus Notes
> and other non MS mail programs still have to worry about the other effects.
> -Nate
>