VIRUS ADVISORY - W32/Sobig.f@MM] sound familiar, Angus?
Posted: Fri Feb 17, 2012 11:28 pm
The risks of virus' from this mailing list should be all but non-existant in
the current configuration... any message with an attachment sent to the list
server is rejected, and a message sent to the sender informing them that
attachments are not allowed. Also, any HTML encoding in a message sent to
the list is stripped away and the message is then sent to list members in
plain text format. This eliminates the risks associated with active X and
java based applications. Finally every e-mail that is received on my server
is individually scanned by norton antivirus (which is updated every 48
hours) before being processed.
So with that said, I feel confident that even should a list member's system
become infected by a virus or a worm, it will not be passed on to any other
list members via the list server. Now, if your personal address is in that
person's address book, then of course I can't do anything to help you.
Mike
----- Original Message -----
From: "Gordon Mohr" <gmohr@telus.net>
To: <murphy-rebel@dcsol.com>
Sent: Wednesday, August 20, 2003 12:42 PM
Subject: [Fwd: VIRUS ADVISORY - W32/Sobig.f@MM] sound familiar, Angus?
fo/VIL/default.asp&genericLeftNav=/VirusInfo/VIL/vil_nav.asp>
the current configuration... any message with an attachment sent to the list
server is rejected, and a message sent to the sender informing them that
attachments are not allowed. Also, any HTML encoding in a message sent to
the list is stripped away and the message is then sent to list members in
plain text format. This eliminates the risks associated with active X and
java based applications. Finally every e-mail that is received on my server
is individually scanned by norton antivirus (which is updated every 48
hours) before being processed.
So with that said, I feel confident that even should a list member's system
become infected by a virus or a worm, it will not be passed on to any other
list members via the list server. Now, if your personal address is in that
person's address book, then of course I can't do anything to help you.
Mike
----- Original Message -----
From: "Gordon Mohr" <gmohr@telus.net>
To: <murphy-rebel@dcsol.com>
Sent: Wednesday, August 20, 2003 12:42 PM
Subject: [Fwd: VIRUS ADVISORY - W32/Sobig.f@MM] sound familiar, Angus?
<http://us.mcafee.com/root/genericURL_ge ... L=/VirusIn
fo/VIL/default.asp&genericLeftNav=/VirusInfo/VIL/vil_nav.asp>
Members Only <http://us.mcafee.com/root/membersOnly.asp> Support
<http://us.mcafee.com/root/support.asp> Downloads
<http://download.mcafee.com/us>
Dear g,
A new variant of W32/Sobig, W32/Sobig.f@MM
<http://us.mcafee.com/root/campaign.asp?cid=8449> is a High Risk
mass-mailing worm. It arrives as an email attachment with a .pif or .scr
extension. When run, it infects the host computer, then emails itself
(using its own SMTP engine) to harvested email addresses from the
victim's machine. In addition, when it propagates, the worm "spoofs" the
"from: field", using one of the harvested email addresses.
Note: The worm copies itself onto the infected machine as:
C:\WINNT\WINPPR32.EXE
Caution: An infected email can come from addresses you recognize and may
contain the following information:
WHAT TO LOOK FOR:
Subject: [content varies]
- Your details
- Thank you!
- Re: Thank you!
- Re: Details
- Re: Re: My details
- Re: Approved
- Re: Your application
- Re: Wicked screensaver
- Re: That movie
Body: [content varies]
- See the attached file for details
- Please see the attached file for details
Attachment: [content varies]
- your_document.pif
- document_all.pif
- thank_you.pif
- your_details.pif
- details.pif
- document_9446.pif
- application.pif
- wicked_scr.scr
- movie0045.pif
Learn More about W32/Sobig.f@MM
<http://us.mcafee.com/root/campaign.asp?cid=8449>
Scan for W32/Sobig.f@MM <http://us.mcafee.com/root/campaign.asp?cid=8450>
Subscribe to a full year of VirusScan Online for just $34.95 and get
SpamKiller free*!
Learn More... <http://us.mcafee.com/root/campaign.asp?cid=8241>
* After $30 mail-in rebate.
SpamKiller stops spam from polluting your inbox. SAVE $15, now only
$24.95. Get only the email you want and nothing else!
Learn More... <http://us.mcafee.com/root/campaign.asp?cid=8242>
VirusScan Online <http://us.mcafee.com/root/campaign.asp?cid=8241>
The #1 anti-virus solution online. Protect your PC from viruses and
receive FREE automatic updates.
Is your protection current
<http://us.mcafee.com/root/campaign.asp?cid=8243>?
Subscribe to VirusScan Online
<http://us.mcafee.com/root/campaign.asp?cid=8241>.
VirusScan 7.0 <http://us.mcafee.com/root/campaign.asp?cid=8244>
Stop viruses, trojans, worms, and more. Now includes enhanced McAfee
Firewall protection to keep hackers out of your PC.
Update DAT file <http://us.mcafee.com/root/campaign.asp?cid=8245>
Purchase VirusScan 7.0 <http://us.mcafee.com/root/campaign.asp?cid=8244>
Upgrade Center <http://us.mcafee.com/root/campaign.asp?cid=8246>
Personal Firewall Plus <http://us.mcafee.com/root/campaign.asp?cid=8350>
Your Defense Against Hacker Attacks! See when someone is trying to hack
your system. Then track and report hacker activity.
Subscribe to Personal Firewall Plus
<http://us.mcafee.com/root/campaign.asp?cid=8350>.
Download McAfee SecurityCenter
<http://us.mcafee.com/root/campaign.asp?cid=8247>
Download a set of FREE security tools and also receive trial versions of
our world-class security services.
Learn more <http://us.mcafee.com/root/campaign.asp?cid=8247>...
<http://us.mcafee.com/root/campaign.asp?cid=8248>
<http://us.mcafee.com/root/campaign.asp?cid=8248>
Product Recommender! <http://us.mcafee.com/root/campaign.asp?cid=8248>
Find the right product for you, click here
<http://us.mcafee.com/root/campaign.asp?cid=8248>.
[ You are currently subscribed as: gmohr@telus.net ]
Please feel free to forward this dispatch to any interested
friends, family and associates.
Subscribe: If you received this message from a friend and
would like to subscribe to eSecurity News, virus
alerts and special offers, click here
<http://dispatch.mcafee.com/us/sub.asp>.
Unsubscribe: If you prefer not to receive future email from
McAfee, please click here <http://dispatch.mcafee.com/us/unsub.asp>.
Need further assistance? Visit McAfee Support
<http://us.mcafee.com/root/support.asp>.
Click here <http://us.mcafee.com/root/campaign.asp?cid=8207> to view our
privacy policy.
McAfee is a business unit of Network Associates, Inc.
3965 Freedom Circle, Santa Clara, CA 95054, (408) 992-8599