Attn: Possible Virus Warning - People On Yahoo Mail?

[Andrew D. Gable]

Today I received a message from a Yahoo administrator saying that my account will be cancelled, but requiring me to open an attachment to find out why. I haven't opened the attachment, luckily, but I'm just wondering if by some chance this is something legit or a virus (as I suspect). I tried running the virus scan that Yahoo provides to check out the message first, but it said that my virus scan is disabled. Anybody else have Yahoo, and get this message?

 

[Nine Hands]

That sounds pretty suspicious. I don't think Yahoo is running around cancelling accounts. You did the right thing by not opening the attachment.

 

[coyote6]

Virus. If our county IT dept. is correct, it's called "Exploit-Codebase".

 

[Jeremy]

First off, love the Avatar. Yay Meng Huo.

Secondly, definately virus. 3 companies I support all took large hits on this virus today. All of them the virus said came from admin@<domain of the recipient>. So if your email address were joe@aol.com, it'd say admin@aol.com.

The attachment was always a zip file. Those who opened it got a black square with red text on their screen.

Delete it without opening or saving the zip file.

 

[kenjib]

W32.Mimail.A. It's hitting really hard right now and is not specific to Yahoo mail.

 

[kenjib]

Forgot to mention that you did the right thing. Never open stuff sent to you via email attachment unless you know exactly what it is (viruses can disguise themselves as coming from your friends so knowing who it's from is not enough). Yahoo mail won't send out information like that, ever. They'll include info in the body of their message, and if you need to update your account it will be done through their web site, not something you download and run. Similarly never give out account information to anyone posing as an administrator of Paypal, eBay, etc. If it really is them, they know your account info and don't need it from you.

If you want to double check that you are clean and don't have a virus scanner, go to the registry at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If you are infected with W32_Mimail.A there will be an entry similar to:

VideoDriver=%WINDIR%\videodriver.exe

If you see that, get a removal tool, such as:

http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.a@mm.removal.tool.html

 

[Andrew D. Gable]

Thanks all. I had a sneaking suspicion it could have been a virus mail. Looks like I was right.

BTW, Jeremy, you're the first person who's recognized the avatar. That's where I'm up to in the book of Three Kingdoms, the Nanman Campaign.

 

[Psionicist]

Do you know what a WORM is or how typical virus works? Do you update your AV software regularly? Do you use e-mail software not coded by microsoft?

If no: Please, never use e-mail again until you do.

If yes: You are knowledgeable enough to know that e-mail attachments are worthless anyway and transfer files by different means.

 

[Umbran]

If yes: You are knowledgeable enough to know that e-mail attachments are worthless anyway and transfer files by different means.

Psionicist, while your dedication to helping others avoid viral infection is laudable, your blanket statement about e-mailing attachments is less so. To you they may be worthless, but please allow the rest of us to figure their value based upon our situation, hm?

Some of us have to deal with folks who are not terribly sophisticated with computers, for whom learning other methods of file transfer is difficult, unintuitive, or even scary.

 

[KingOfChaos]

What I do is I never open an attachment from someone who hasn't notified me that they're sending me one prior to actually transfering the file. It seems to work well.