[MATHEDCC] VIRUS ALERT

Larry Husch (husch@MATH.UTK.EDU)
Thu, 16 Dec 1999 08:55:32 -0500 (EST)

Earlier I sent you a message about an email message which apparently came
from the mailing lists mathedcc and mathlib which had an attachment. On
further investigation, I have found that this attachment DOES CONTAIN A
VIRUS. This virus is called W32.NewApt.Worm or Worm.NewApt. You can
view the information about this virus on the webpage

http://www.symantec.com/avcenter/venc/data/worm.newapt.html

This is a new virus, discovered December 14. From the site above, "This
worm will email itself out when receiving email via Microsoft Outlook or
Netscape Navigator. When activated, the worm will display an error dialog
and modify the registry so the worm is reloaded each time the
computer is restarted". The first indication of the virus is in the second
message of Bonnie Edwards to MATHEDCC on Dec. 15. Since there are no
attachments to Bonnie's email, Bonnie's computer was not infected at that
time and so the virus was not propogated on the mailing list with Bonnie's
message.

I checked the logs of both MATHEDCC and MATHLIB and found out that
message which I received this morning was not sent by either of the
mailing lists. From the description of the behavior of the virus, since
I had sent out a message to MATHEDCC a couple of weeks ago, the virus is
on one of the subscribers computers. Since Bonnie and I both sent
messages to the list, the virus sent us a message back using the phony
"From:" with the attachment containing itself.

So I encourage all MATHEDCC subscribers to check their computer if they
fit the profile listed on the Symantec site. Since this is a new virus,
you will probably need an update of your virus checker. Again, I repeat
the warning which I gave earlier today of not opening attachments to
messages which you are not expecting.

Best,
Larry
------------------------------------------------------------------------
Larry Husch phone: 423-974-4162 fax: 423-974-6576
Mathematics Department http://www.math.utk.edu/~husch
University of Tennessee Co-Director, Mathematics Archives
Knoxville, TN 37996-1300 http://archives.math.utk.edu/

****************************************************************************
* To post to the list: email mathedcc@archives.math.utk.edu *
* To unsubscribe, send mail to: majordomo@archives.math.utk.edu *
* In the mail message, enter ONLY the words: unsubscribe mathedcc *
* Words in the Subject: line are NOT processed! *
* Archives at http://archives.math.utk.edu/hypermail/mathedcc/ *
****************************************************************************