Re: WARNING virus detected in IMAGELIB message

From: Marta Bernal Jimenez (mbernalj@inter.edu)
Date: Mon Apr 29 2002 - 09:08:28 CDT

  • Next message: Real, Will: "MD5 Checksum Utility" 

    Message-Id: <200204291321.g3TDLtx21131@sitelicense.arizona.edu>
Date:         Mon, 29 Apr 2002 10:08:28 -0400
From: Marta Bernal Jimenez <mailto:mbernalj@inter.edu>
Subject:      Re: WARNING virus detected in IMAGELIB message
To: mailto:IMAGELIB@listserv.arizona.edu

    <pre> This is a multi-part message in MIME format.
    --------------71ABF04135127D46C688A44C Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit

    Thanks for the information, it seems others already opened it and may be infected Marta

    Stuart Glogoff wrote:

    > Saturday morning Tucson, AZ, USA, 10:55
    >
    > I received a message from the virus detection software on our
    > listserv'er at the UA to owner-imagelib that
    > "Network Associates WebShield SMTP V4.5 MR1a on chkmail detected virus
    > mailto:W32/Klez.h@MM
    > in attachment unknown from <mailto:owner-IMAGELIB@listserv.arizona.edu> and it
    > was Deleted
    > and Quarantined."
    >
    > I believe that this message is responsible.
    >
    > Subject: A special funny game
    >
    > Imagelib is closed to postings outside of subscribers. I believe I
    > identified the sender and deleted his subscription. I'm consulting with
    > the systems admin for the campus listserv'er and with our SERT director
    > for other steps to protect the listserv. Will advise as info becomes avail.
    >
    > Following is a message I got from a Edward Parkin about the virus
    > attached to the message.
    > ***
    > I received IMAGELIB Digest - 25 Apr 2002 to 26 Apr 2002 (#2002-59) and
    > it contained a virus. I tried to send the following message out to the
    > listserv to warn everyone, but you wouldn't allow me to post. I think
    > that it should be an obligation you have to allow virus warnings to be
    > issued by subscribers when found, or to thoroughly screen postings and
    > prevent malicious viruses from infecting peoples computer. I was
    > protected from this virus, but how many people will be who are
    > subscribed to the list. Please send out a warning before it's too late.
    > The infected attachment is an EXE file similar to the name picacu.exe.
    > Here's the message I tried to post to the listserv:
    >
    > warning that this message you received earlier has a virus. If you don't =
    > have a virus checker or it's out of date then you might have missed it. =
    > The virus is called mailto:w32.klex.ben@mm and is in the file attached to the =
    > email.=
    > Just letting you know. hope it's not too late.
    > ***
    > Please write me directly at mailto:stuartg@u.arizona.edu if you have specific
    > questions. I'll try to get answers.
    > Stuart
    >
    > Stuart Glogoff
    > Manager, Distributed Learning Projects
    > Room 337 Computer Center
    > Tucson, AZ 85721-0073
    > (520) 626-5347
    > FAX (520) 626-8220

    --------------71ABF04135127D46C688A44C Content-Type: text/x-vcard; charset=us-ascii;
     name="mbernalj.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Marta I. Bernal Jiménez Content-Disposition: attachment;
     filename="mbernalj.vcf"

    begin:vcard n:Bernal Jiménez;Marta I. tel;fax:(787)250-0878 tel;work:(787)250-1912 X-2471 x-mozilla-html:FALSE org:Universidad Interamericana de PR - Oficina Central del Sistema;Centro de Procesos Técnicos adr:;;PO Box 191293;San Juan;PR;00919-1293; version:2.1 email;internet:mailto:mbernalj@inter.edu title:Coordinadora de Información Digital y de Proyectos Especiales fn:Marta I. Bernal Jiménez end:vcard

    --------------71ABF04135127D46C688A44C--

    </pre>

    This archive was generated by hypermail 2b29 : Mon Apr 29 2002 - 08:22:33 CDT