Dear Everyone!
This is the real thing and seems to be spreading fast, please configure
your antivirus product running on the SMTP and the Exchange servers to block
all attachments coming through with the extension .EXE or block the files
coming through with the name README.EXE.
Using eManager for InterScan you can block using Anti-Spam filter, to block
all README.EXE or *.EXE.
Richard Ku
-----Original Message-----
From: William Smith [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 9:45 AM
To: Exchange Discussions
Subject: RE: New Virus / Worm ??
It's a new/variant worm, possibly related to this:
http://www.zdnet.com/eweek/stories/general/0,11011,2810273,00.html
W
-----Original Message-----
From: Andrew Chan [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 12:41 PM
To: Exchange Discussions
Subject: RE: New Virus / Worm ??
It's time to activate those Content Filter features, AGAIN...
:-)
Andrew,
MCSE (NT & W2K) + CCNA
-----Original Message-----
From: John Matteson [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 8:32 AM
To: Exchange Discussions
Subject: New Virus / Worm ??
I received an E-mail from a person that I didn't know this morning, and
the subject line was a lot of nonsense characters. Using Outlook 2000 I
highlighted it and it kicked off the attachment, which opened Media
Player and tried to play a file, but got a content error.
Here is the header from the message as it was received. Anyone have any
ideas about this?
===================
Received: from COURRIER (mail.stadacona.ca [207.236.164.198]) by
mx2.geac.com with SMTP (Microsoft Exchange Internet Mail Service Version
5.5.2653.13)
id T1K1YYZM; Tue, 18 Sep 2001 09:56:21 -0400
From: [EMAIL PROTECTED]
To:
Subject:
Xodco0411odco0804odco040alogv040abedsnotebeclassodco0804bedsnotebootodco
0407
logv0409exgu040aodco0412avco040cbootmoderatravco0411unstdllodco040clogv0
404o
dco040cbebsdulogv0412odco0407
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
boundary="====_ABC0987654321DEF_===="
--====_ABC0987654321DEF_====
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
--====_ABC0987654321DEF_====--
--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID: <EA4DMGBP9p>
John Matteson; Exchange Manager
Geac Corporate Infrastructure Systems and Standards
(404) 239 - 2981
...the words that I remember from my childhood still are true, that
there are none so blind as those who will not see.... --The Moody Blues
(I know you're out there)
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
