[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference powdml::pc_security

Title:PERSONAL COMPUTER SECURITY
Notice:SWEEP servers Note 5; more info on www-is-security.mso.dec.com
Moderator:BSS::BOREN
Created:Wed Jan 02 1991
Last Modified:Fri Jun 06 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:504
Total number of notes:2905

500.0. "Happy Birthday/Virus ???" by AKOCOA::POSCO () Tue May 13 1997 10:52

     Has anyone heard of a virus that creates a Happy Birthday
    screen/dialog box when starting Microsoft Word. To get out
    of it to enter Ms Word you have to click on Puff button.
     I have seen it on 2 Pc's in AKO. Any comments on this is
    appreciated.. 
    
    Thanks, Mark
T.RTitleUserPersonal
Name		DateLines
500.1PCBUOA::DEWITTchasing rainbows...Tue May 13 1997 12:138
    	Found it on my system this a.m. - Sweep 95 (2.97 I believe is the
    version) elminates it.  Downloaded it from www-security.mko.dec.com
    
    	I didn't click the puff button, I used ctrl, alt, del to get out of
    Word.  Before I got the latest version of Sweep 95, it began
    multiplying.
    
    Joyce
500.2Winword/OfxxKAOFS::trp147.tro.dec.com::achanArthur Chan @TROWed May 14 1997 14:5414
Hi,

	The virus that you have encountered is a variant 
of Winword/Ofxx.  This virus does not have a destructive payload, 
it's more of a nuisance.  The "Puff" button is used to remove the 
dialog box.  

	As .2 mentioned, run Norton AntiVirus, Sweep or F-Macrow to 
disinfect.

Regards,
Arthur Chan
I.T. Security
500.3PCBUOA::DEWITTchasing rainbows...Thu May 15 1997 15:587
    re .2
    
    	Any idea of the source on this one?  
    
    Thanks
    
    Joyce
500.4Not much info on this one ...KAOFS::trp147.tro.dec.com::achanArthur Chan @TROTue May 20 1997 17:327
Hi Joyce,

	Winword/Ofxx was found in the US at the end of 1996.

Regards,
Arthur
500.5PCBUOA::DEWITTchasing rainbows...Wed May 21 1997 12:246
    	Arthur, thanks.  I was hoping for a clue on how it ended up on my
    pc.   Oh well, guess its a "never know".
    
    Thanks again!
    
    joyce