Printed Circuit Board Assembly & PCB Design SMT Electronics Assembly Manufacturing Forum

Printed Circuit Board Assembly & PCB Design Forum

SMT electronics assembly manufacturing forum.


Warning! Somebody is sending virus files!

Steve Gregory

#12307

Warning! Somebody is sending virus files! | 13 March, 1999

Good morning fellow SMTnetters,

Upon opening my email this morning, I had two emails from the following email address: evcons@ms3.hinet.net with "Evergreen PCB" in the subject box and it had a file attachment called Happy99.exe...I suppose whoever sent me this email thought I fell off the cabbage truck yesterday. This file is a Trojan, a virus.

If any of you recieve the same email don't download it! I'm not sure if this person got my email address from here on the SMTNET or on the IPC TechNet where I'm a list member...but because of the subject "Evergreen PCB" I'm sure it's from one of these two places...they are the only places I go on the NET to communicate about electronic assembly. Just thought I'd give ya'll a heads up...

-Steve Gregory-

reply »

Wayne B

#12308

Re: Warning! Somebody is sending virus files! | 14 March, 1999

Thanks Steve:

Think I got the same email from "Evergreen PCB" I deleted it without thinking. maybe a good thing.

Wayne

| Good morning fellow SMTnetters, | | Upon opening my email this morning, I had two emails from the following email address: evcons@ms3.hinet.net with "Evergreen PCB" in the subject box and it had a file attachment called Happy99.exe...I suppose whoever sent me this email thought I fell off the cabbage truck yesterday. This file is a Trojan, a virus. | | If any of you recieve the same email don't download it! I'm not sure if this person got my email address from here on the SMTNET or on the IPC TechNet where I'm a list member...but because of the subject "Evergreen PCB" I'm sure it's from one of these two places...they are the only places I go on the NET to communicate about electronic assembly. Just thought I'd give ya'll a heads up... | | -Steve Gregory- |

reply »

Steve Gregory

#12309

Re: I found out who the scum is! | 14 March, 1999

| Thanks Steve: | | Think I got the same email from "Evergreen PCB" I deleted it without thinking. maybe a good thing. | | Wayne

Hi ya' Wayne!

I just found out who sent the virus, the answer was as close as the TechNet archives. I pasted an email from he slimeball below. Why he's sending out viruses out to people on the TechNet and SMTNET is beyond me. But if you do business with this company you might consider doing business with someone else.

The email address on the September 1997 email from the TechNet archives that I pasted below, is PRECISELY the same email address that sent me the virus, along with the name eddy. I am not making any of this up, and I still do have a copy of his email with the virus attached to it...I haven't downloaded it is all.

I replied to his original email with the virus in language that I would not print here, so he knows exactly how I feel. But I thought most of you would be interested in what I found...by the way, I found this by going to www.dogpile.com and typing in: evergreen pcb. Pretty darn good search engine!

If is sounds like I'm being a little too vengeful, I don't think so. Not to long ago I just dealt with all of our computers at work being infected with the LaRouxe virus (affects Excel), it came in on a disk that had a B.O.M. from one of our customers. A good lesson, ALWAYS scan any disk you put in your 'pooters whether they're from a customer or not...and update your antivirus software often. These 'friggen hackers come up with new viruses daily.

It was a real pain in the butt because we had the computer back in the stockroom, the receptionists computer, and shipping, that got infected and they don't have a modem. The version of Norton that was on them didn't detect the LaRoux virus.. you needed to have the latest and greatest virus definition which was only available in an online update. So when we first discovered the infection on one of our computers, everybody scanned. Some detected it, some didn't. But unfortunately, we didn't key in on the different version Norton thing 'till we kept seeing the updated computers detecting Laroux time and time again.

Viruses are nothing but destructive. Anybody that I can nail who sends this crap out deserves as much punishment as possible in my book... especially seeing how much of all of our lives depend on error free computing.

-Steve Gregory-

From: Eddy[SMTP:evcons@ms3.hinet.net] Sent: Tuesday, September 09, 1997 9:58 AM To: Tucker, Steve (KS) Subject: EVERGREEN PCB

Dear Mr. Steve (KS) Tucker, Evergreen PCB, locate in Taiwan, is professional PCB Manufacturer with many years of Experiences in PCB FIELD .We do provide the most reliable PCB. OUR RELIABLE QUALITY AND LOW PRICE WILL MAKE YOUR PRODUCTS MORE COMPETITIVE. COMMERCIAL TO IPC STANDARDS,UL APPROVED

Evergreen PCB NUMBER OF LAYER: 4~6 LAYERS ~ SINGLE SIDE UP TO 10LAYERS MIN. INNER LAYER THICKNESS: 0.016ins MIN. FINISH HOLE SIDES: 0.014ins MIN. LINE WIDTH/SPACING: 0.004* MIN. SMD PITCH: 0.018 Min. THICKNESS TOLERANCE: +/- 0.003* MAX. PANEL SIZE: 24x22ins Electrical test Voltage: 250V GOLD PLATING(ENTIRE BOARD): >5 GOLD PLATING (EDGE CONNECTORS): UP TO 50 MAX. MONTHLY PRODUCTS: 300,000sf FOR ODM OR OEM PLEASE CONTACT US Best regards, Eddy Chen EVERGREEN HITECH CONSULTANTS LTD. TEL:886-2-7667722 FAX:886-2-7630734 E-MAIL: mailto:evcons@ms3.hinet.net 7th Fl., No. 35, Lane 13, KWAN FU SOUTH ROAD, TAIPEI, TAIWAN http://www.asiansources.com/evhitech.co

(Steve.Tucker@ALLIEDSIGNAL.COM) Tue, 9 Sep 1997 11:52:15 -0700 Messages sorted by: [ date ][ thread ][ subject ] Next message: Jeff McGlaughlin: "[TECHNET] FW: EVERGREEN PCB -Reply" Previous message: Aric J Parr: "Re: [TECHNET] ASSY: PARTS SOLDERABILITY" Next in thread: David Tyler: "Re: [TECHNET] FW: EVERGREEN PCB"

Hello Technet, I am certain that I am not the only one in the group to have gotten a message from Mr. Chen, nor am I the only one that is disturbed by solicitors using this forum to gather names. I believe Mr. Chen sent an advertisement to all of technet recently. Are there any suggested actions that could be taken to prevent this very useful forum from being overrun by telemarketers?

Regards, Steve Tucker

reply »

P.L. Sorenson - Technical Consultant

#12310

Re: Warning! Somebody is sending virus files! | 15 March, 1999

| Good morning fellow SMTnetters, | | Upon opening my email this morning, I had two emails from the following email address: evcons@ms3.hinet.net with "Evergreen PCB" in the subject box and it had a file attachment called Happy99.exe...I suppose whoever sent me this email thought I fell off the cabbage truck yesterday. This file is a Trojan, a virus. | | If any of you recieve the same email don't download it! I'm not sure if this person got my email address from here on the SMTNET or on the IPC TechNet where I'm a list member...but because of the subject "Evergreen PCB" I'm sure it's from one of these two places...they are the only places I go on the NET to communicate about electronic assembly. Just thought I'd give ya'll a heads up... | | -Steve Gregory- | A day after I read this message, I was forwarded a warning about this specific virus from an Australian colleague. I have cut and pasted it below. Note that the sender of the virus probably isn't aware that he is sending it out with his mail. According to the message below, this virus, once you have it, attaches itself to all your outgoing mail. -- >>>Date: Fri, 12 Mar 1999 12:09:57 +1000 >>>From: Paul Hardaker >>>Subject: [h-all] WARNING: Win32/Ska.A (Happy99) Worm >>>Sender: owner-h-all@ob1.uws.edu.au >>> >>>A relatively new, and quite serious "virus" (really a Worm or >>>Trojan Horse) called Win32/Ska or Happy99 is appearing on campus. >>> >>>This "worm" generally arrives on your computer via email. If it >>>manages to install itself on your computer, it sends a copy of >>>itself via email every time you send a genuine email message to >>>anyone. In effect, you become an unwitting party in sending copies >>>of the worm to your colleagues. >>> >>>The worm is specific to Win32 machines - ie, Windows 95, Windows 98 >>>and Windows NT. Other computer systems are not believed to be >>>vulnerable. >>> >>>For your PC to become infected, you must decode and run a program >>>called HAPPY99.EXE which is attached to an email message from someone >>>already infected with the Worm. The HAPPY99 program displays the >>>message "Happy new year 1999" while showing a fireworks display when >>>it is run. >>> >>>Fortunately, the normal Email client uses on campus (Eudora), does >>>not automatically decode (or execute) the HAPPY99.EXE attachment >>>(due to the "uuencode" encoding system used), so Win95/98/NT users >>>of Eudora are also not believed to be vulnerable unless they manually >>>decode and execute the HAPPY99.EXE attachment. >>> >>>If you think there is a possibility that your PC has become infected >>>with the HAPPY99 Worm do not send any email messages or newsgroup >>>postings until your PC and been checked and, if necessary, the Worm >>>removed. >>> >>>If you think you have received an email message from someone >>>containing the encoded HAPPY99.EXE program, please advise the sender >>>immediately that their PC is infected with the Worm, and that they >>>should not send any more email messages until the Worm is removed >>>from their PC. >>> >>>The Worm does not appear to cause any specific damage to your PC, >>>however the program could cause your PC to operate incorrectly, and >>>it certainly does consume resources (disk space, memory, CPU time). >>> >>>The McAfee update file on the Hawkesbury Intranet page does not >>>currently detect or remove the Happy99 Worm. A new update file will >>>be made available as soon as possible. >>> >>>You can find out more about the Happy99 Internet Worm at: >>> >>> http://www.symantec.com/avcenter/venc/data/happy99.worm.html >>> http://www.avertlabs.com/public/datafiles/valerts/vinfo/w32ska.asp >>> http://www.datafellows.com/v-descs/ska.htm >>> >>>Paul Hardaker >>>Network Analyst >>>UWS Hawkesbury >>>Richmond NSW Australia >>> >>>Email: P.Hardaker@uws.edu.au >>>Phone: 02-4570-1446 (Int: +61-2-4570-1446) >>>Fax: 02-4570-1800 (Int: +61-2-4570-1800)

reply »

Cliff

#12311

Re: Warning! - an extra note | 15 March, 1999

I agree with P.L. Sorenson. This virus (not really a virus, but a program with bad intentions) has been designed to replicate and distribute itself, without permission or knowledge of the one sending mail. And the only way the infected person will know is if someone tells him.

I have received it a few times, and the only real threat this program has, is that it slows traffic and cloggs networks.

It is easily removed: http://www.symantec.com/avcenter/venc/data/happy99.worm.html

Luckily the program (happy99.exe) doesn't do anything worse, like disable the operating system or delete precious files. I suspect that someone will create one that does at some time in the future. Best is to be aware that they exist and that EXE files should be cautiously executed.

Cliff

reply »

ICT Total SMT line Provider

IPC Training & Certification - Blackfox