Re: virus warning - may be in previous FairVoteMD message

Stephen Jascourt jascourt at earthlink.net
Fri, 21 Dec 2001 01:18:43 -0500

The previous message posted on FairVoteMD - the text (not infected) part of
which is included below, appears to be of the sort that has a virus in the
attachments. I highly recommend NOT OPENING the attachments in the original
(not included here). I was not the sender and I did notify the sender. 
The characteristics of many computer viruses are 
1) a random old message from the "out" mailbox is sent with a random file
attached. It makes no sense in context. For instance, this message seems to
have no connection to Fairvote Maryland. The virus is in the attached file
and activates when you open the attachment. The virus is not in the email
message text, you cannot get the virus by reading the message, you get the
virus by opening the attachment (if your email program automatically opens
and displays attachments then you have a problem; mine does not, it simply
lists it and I have to click on it to open).
2) the reply-to address or sender address is changed in one character - for
instance, note the header in the email:
>X-Sender: saywatts@igc.org
>X-Apparently-To: fairvotemd@yahoogroups.com
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook Express 5.00.2919.6600
>From: Raymond D. Watts <raywatts@igc.org>

Note the X-Sender is changed from the From: email name.

3) note that the mailer sending it is Microsoft Outlook. This is also typical.

4) a trick you can do if you are extremely careful is to find the
attachment using "my computer" - do NOT click on it with the left button,
click on it with the right button to change the name, and change the name
to end in .txt and open it in Notepad (make sure you have txt files set to
open in Notepad and not in Word, if it opens in Word you may get infected).
It will not run and the virus will not be activated. You will see all sorts
of funny non-alphabetic characters but you will also see any  readable text
in the file. If it looks like it has computer system kinds of words or
anything with dll in it then there's a good chance it may have a virus, and
regardless, if there's any text you need to read in it, you can read it
this way without much risk. But you have to be careful! I have done this
but I do not recommend it for those not computer savvy.

Stephen



At 11:55 PM 20-12-01 -0500, Raymond D. Watts wrote:
>The final liquidating distributions, however, will take place upon receipt
of tax clearance from the Department of Revenue Services and then the
determination of final expenses with some degree of certainty.  Although I
must defer to Seth concerning the timing of the filing of the final tax
returns, we often file final returns in advance of the fiscal year-end when
the entity has been terminated previously.
>
>	1.2	I would expect that Arthur GinsbergÂ?s liquidating distribution will
be made directly to him, or his assignee, if he and Jennifer have resolved
that aspect of their settlement by the time we are in a position to make
the distribution.
>
>To unsubscribe from this group, send an email to:
>FairvoteMD-unsubscribe@egroups.com
>
>To subscribe, if this has been forwarded to you, send an email to:
>FairvoteMD-subscribe@egroups.com
>
>Also see the Center for Voting and Democracy's website, www.fairvote.org
for more information about instant runoff voting and other electoral reforms.
> 
>
>Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ 
>
>
>Attachment Converted: "c:\eudora3.05\attach\effective.exe"
>
>Attachment Converted: "c:\eudora3.05\attach\anne & ray watts1.doc"
>

Stephen Jascourt   jascourt@earthlink.net
http://home.earthlink.net/~jascourt/