WARNING virus detected in IMAGELIB message

From: Stuart Glogoff (stuartg@U.ARIZONA.EDU)
Date: Sat Apr 27 2002 - 12:58:35 CDT

  • Next message: Marta Bernal Jimenez: "Re: WARNING virus detected in IMAGELIB message" 

    Message-Id: <200204271752.g3RHqZx14040@sitelicense.arizona.edu>
Date:         Sat, 27 Apr 2002 10:58:35 -0700
From: Stuart Glogoff <mailto:stuartg@U.ARIZONA.EDU>
Subject:      WARNING virus detected in IMAGELIB message
To: mailto:IMAGELIB@listserv.arizona.edu

    <pre>
     Saturday morning Tucson, AZ, USA, 10:55

    I received a message from the virus detection software on our listserv'er at the UA to owner-imagelib that
    "Network Associates WebShield SMTP V4.5 MR1a on chkmail detected virus mailto:W32/Klez.h@MM in attachment unknown from <mailto:owner-IMAGELIB@listserv.arizona.edu> and it was Deleted and Quarantined."

    I believe that this message is responsible.

    Subject: A special funny game

    Imagelib is closed to postings outside of subscribers. I believe I identified the sender and deleted his subscription. I'm consulting with the systems admin for the campus listserv'er and with our SERT director for other steps to protect the listserv. Will advise as info becomes avail.

    Following is a message I got from a Edward Parkin about the virus attached to the message.
    *** I received IMAGELIB Digest - 25 Apr 2002 to 26 Apr 2002 (#2002-59) and it contained a virus. I tried to send the following message out to the listserv to warn everyone, but you wouldn't allow me to post. I think that it should be an obligation you have to allow virus warnings to be issued by subscribers when found, or to thoroughly screen postings and prevent malicious viruses from infecting peoples computer. I was protected from this virus, but how many people will be who are subscribed to the list. Please send out a warning before it's too late. The infected attachment is an EXE file similar to the name picacu.exe. Here's the message I tried to post to the listserv:

    warning that this message you received earlier has a virus. If you don't = have a virus checker or it's out of date then you might have missed it. = The virus is called mailto:w32.klex.ben@mm and is in the file attached to the = email.= Just letting you know. hope it's not too late.
    *** Please write me directly at mailto:stuartg@u.arizona.edu if you have specific questions. I'll try to get answers. Stuart

    Stuart Glogoff Manager, Distributed Learning Projects Room 337 Computer Center Tucson, AZ 85721-0073
    (520) 626-5347 FAX (520) 626-8220

    </pre>

    This archive was generated by hypermail 2b29 : Sat Apr 27 2002 - 12:53:16 CDT