Security Alert: Virus Emails - You've received A Hallmark E-Card!
Who: Everyone
What: Virus Emails - You've received A Hallmark E-Card!
When: July 23, 2008
How:
Virus emails have recently been sent to Carnegie Mellon email accounts claiming to be from "postcards@hallmark.com". The messages include a postcards.zip or similarly named attachment. PLEASE DO NOT OPEN THE ATTACHMENT!
A sample of the virus message follows:
From: postcards@hallmark.com
Sent: Wed, July 23, 2008 10:22 am
Subject: You've received A Hallmark E-Card!
You have recieved A Hallmark E-Card. Hello!
You have recieved a Hallmark E-Card from your friend.
To see it, check the attachment.
There's something special about that E-Card feeling. We invite you to make a friend's day and send one.
Hope to see you soon,
Your friends at Hallmark
Your privacy is our priority. Click the "Privacy and Security" link at the bottom of this E-mail to view our policy. Hallmark.com | Privacy & Security | Customer Service | Store Locator
What You Need To Do:
If you suspect your computer has already been compromised, STOP! Read and follow Responding to a Compromised Computer.
If your computer is managed by a Carnegie Mellon departmental computing administrator, please consult that person before making any system changes.
Follow the detailed steps below:
- If you opened the attachment, your machine is likely infected and will need to be cleaned via the following:
- If you do not have Symantec AntiVirus installed or have problems with these directions, contact your departmental computing administrator or the Computing Servics Help Center at x8-HELP(4357) or send email to advisor@andrew.cmu.edu.
- If your wireless connection was suspended, plug into a wired connection to access FirstConnect (no registration required.) If your wired connection was suspended, you can still access FirstConnect while suspended on wired. FirstConnect will allow you to download files from Symantec's website while suspended or unregistered.
- Download and save the following file to your Desktop: Symantec AntiVirus Rapid Release Definitions (symrapidreleasedefsx86.exe)
- Locate and run symrapidreleasedefsx86.exe or symrapidreleasedefsx86 to upgrade your Symantec AntiVirus definitions. Wait for it to complete.
- Turn off System Restore using these Symantec directions.
- Perform a full virus scan of your computer:
- Launch Symantec AntiVirus.
- From the Scan menu, select Full Scan.
- Press the Scan button in the lower right corner.
- Wait for the scan to complete and clean the infection.
- Turn on System Restore using these Symantec directions.
- If your computer was suspended, follow the instructions in the suspension email to request restoration.
- If you received or opened the message and did not open the attachment, enable spam filtering and delete the message.
See Enable Spam Filter Using Portal
- Secure Your Computer***
Mac instructions
Windows Vista instructions
Windows XP instructions
Contact:
Please direct any questions or comments to the Computing Services Help Center at x8-HELP (4357) or advisor@andrew.cmu.edu, or to your departmental administrator or DSP consultant.
