[NHCOLL-L:533] RE: Virus warning about e-mail to this group

[Gerald Noonan]

         A check of the note I hastily wrote when I got the virus warning 
shows that the subject title of the e-mail also included NHCOLL-L:523. 
After I sent the warning to the group, I checked e-mail and found that 
Norton only deleted the attachment, the email message was still there. Many 
email programs produce strange attachments that are sent along with them 
and in my Eudora program end up in the attach folder without the email 
message ever having any info about an attachment. Below is the message a 
fellow staff member sent me about the virus worm and how it is spread.
X-NAV-TimeoutProtection0: X
X-NAV-TimeoutProtection1: X
X-NAV-TimeoutProtection2: X
X-NAV-TimeoutProtection3: X
X-NAV-TimeoutProtection4: X
X-NAV-TimeoutProtection5: X
X-NAV-TimeoutProtection6: X
Status: U
Return-Path: <kl at mpm.edu>
Received: from mpm.edu ([192.168.1.134]) by poweredge.mpm.edu
(Netscape Messaging Server 3.62) with ESMTP id 583
for <carabid at mpm.edu>; Wed, 19 Apr 2000 14:51:14 -0500
Message-ID: <38FE0E03.15B61C42 at mpm.edu>
Date: Wed, 19 Apr 2000 14:50:27 -0500
From: "Kevin Lyman" <kl at mpm.edu>
Organization: Milwaukee Public Museum
X-Mailer: Mozilla 4.7 [en] (Win98; I)
X-Accept-Language: en
MIME-Version: 1.0
To: carabid at mpm.edu
Subject: Re: [NHCOLL-L:526] Virus warning about e-mail to this group
References: <4.2.2.20000419130943.00aa0b70 at 127.0.0.1>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Gary, here is info on WScript.kak Worm from SYMANTEC:
VBS.KakWorm spreads using Microsoft Outlook Express. It attaches itself to all
outgoing messages via the Signature feature of Outlook Express and Internet
Explorer newsgroup reader.
The worm utilizes a known Microsoft Outlook Express security hole so that a 
viral
file is created on the system without having to run any attachment. Simply 
reading
the received email message will cause the virus to be placed on the system.
Microsoft has patched this security hole. The patch is available from 
Microsoft's
website. If you have a patched version of Outlook Express, this worm will 
not work
automatically.
More info at http://www.symantec.com/avcenter/venc/data/wscript.kakworm.html

--
Kevin J. Lyman, Curator of Non-vascular Plants
Section for Botany
Milwaukee Public Museum, Inc.
800 W. Wells St.
Milwaukee WI 53233-1478
Phone: (414) 278-6142
Fax: (414) 278-6100



At 03:37 PM 4/19/2000 -0400, Roberta Faul-Zeitler wrote:
>My version of this notice did NOT have an attachment ABOVE the title line.
>Are you certain that when it was sent to NHCOLL members that it had an
>attachment to it ?
>
>Could others respond and indicate whether they have an attachment to this
>NHCOLL announcement ?
>
>Thanks. Quite concerned, Bobbie
>
>Roberta Faul-Zeitler
>Executive Director
>Association of Systematics Collections
>1725 K Street NW, Suite 601
>Washington DC 20006
>Tel. (202) 835-9050
>FAX (202) 835-7334
>Email: faulzeitler at ascoll.org
>
> > -----Original Message-----
> > From: owner-nhcoll-l at lists.yale.edu
> > [mailto:owner-nhcoll-l at lists.yale.edu]On Behalf Of Gerald Noonan
> > Sent: Wednesday, April 19, 2000 2:15 PM
> > To: nhcoll-l at lists.yale.edu
> > Subject: [NHCOLL-L:526] Virus warning about e-mail to this group
> >
> >
> >       On my computer I have Norton AntiVirus set to scan each
> > incoming e-mail
> > for viruses. It notified me that an attachment to a message sent to this
> > group had a virus. The message header apparently read New Publication
> > --Murray's Museums Their History and Their Use. The Norton  alert notice
> > said that the virus was in attachment unk0000.unk to the above
> > message and
> > that the virus was something called a WScript.kakWorm. I had Norton
> > antivirus delete the entire e-mail message and attachment so I can't
> > provide any more information. People might want to be very careful about
> > opening the attachment to anything that has a title similar to the one
> > given above.
> > *************************************************
> > * Gerald R. Noonan Ph.D., Curator of Insects,                    *
> > * Milwaukee Public Museum                                               *
> > * 800 W.
> > Wells
> >          *
> > * Milwaukee, Wisconsin 53233                                           *
> > *
> > carabid at .mpm.edu
> >            *
> > * voice (414) 278-2762
> >             *
> > * fax (414)
> > 278-6100                                                            *
> > *************************************************
> >

*************************************************
* Gerald R. Noonan Ph.D., Curator of Insects,                    *
* Milwaukee Public Museum                                               *
* 800 W. 
Wells                                                                      *
* Milwaukee, Wisconsin 53233                                           *
* 
carabid at .mpm.edu                                                             *
* voice (414) 278-2762                                                        *
* fax (414) 
278-6100                                                            *
************************************************* 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.yale.edu/mailman/private/nhcoll-l/attachments/20000419/07aa1d58/attachment.html