worm alert

From: Pamela Tom (pdtom@ucdavis.edu)
Date: Sun Jun 17 2001 - 22:59:31 PDT

  • Next message: Pamela Tom: "Food Technologist Position"

    To: Seafood HACCP Listserv
    Fr: Pamela Tom, Listserv Owner

    The following message is aimed at informing, not alarming, listserv
    subscribers about a worm that is making the rounds. You might receive the
    independently transmitted worm from any computer (via a listserv, or
    friend). The best solution is to be sure that your antivirus software is
    current. The worm is attached if you get a message that says:

    > Take a look to the attachment.

    and also includes any of the following file names:

                         Pics.ZIP.scr
                         images.pif
                         README.TXT.pif
                         New_Napster_Site.DOC.scr
                         news_doc.scr
                         hamster.ZIP.scr
                         YOU_are_FAT!.TXT.pif
                         searchURL.scr
                         SETUP.pif
                         Card.pif
                         Me_nude.AVI.pif
                         Sorry_about_yesterday.DOC.pif
                         s3msong.MP3.pif
                         docs.scr
                         Humor.TXT.pif
                         fun.pif

    Within the past two days I have e-mailed a couple of messages to this
    listserv, and I have received identical worms, W32.Badtrans.13312@mm, from
    two listserv subscribers from different parts of the world.

    With my luck, yesterday's first attachment that I got was
    "Me-nude.AVI.pif" and that was a real tip-off that something was awry with
    the message that I received. Today's attachment included the file name,
    "card.pif." The broken phrase which is the big giveaway that you have the
    worm is , "> Take a look to the attachment." precedes the attached file
    name.

    I have notified the subscribers and informed them that I have unsubscribed
    them to the listserv and that they may resubscribe after they remove the
    worm from their computer.

    Here's how the worm works: It is a MAPI worm that replies to all unread
    messages in your email message folders and drops a backdoor Trojan.

    Fortunately, removal of the worm is easy.

    The website with information on this specific worm is at:
    http://www.symantec.com/avcenter/venc/data/w32.badtrans.13312@mm.html

    For general inquiries on worms and viruses, go to http://www.symantec.com
    then choose the menu option for "Symantec AntiVirus Research Center."

    --------------------------------------------------------------
    This is the Seafood HACCP Discussion Group. Information is
    available on the web at:
    http://seafood.ucdavis.edu/listserv/Listserv.htm
    For inquiries on subscribing to the list, e-mail: pdtom@ucdavis.edu

    To subscribe, e-mail listproc@ucdavis.edu with the message:
    subscribe seafood [your first name] [your last name]
    To unsubscribe, e-mmail listproc@ucdavis.edu with the message:
    unsubscribe seafood

    Files from the seafood HACCP listserv are now archived at:
    http://listproc.ucdavis.edu/archives/seafood/
    --------------------------------------------------------------



    This archive was generated by hypermail 2b29 : Sun Jun 17 2001 - 23:05:55 PDT