Just a note....

[Tim Wunder]

Bill Day wrote:
> Somone on the list with their WinClient is currently infected with a email 
> worm virus.
> 
> Currently little info is known about the worm.  Doug has determined that it 
> may contain its own SMTP code and it picking addreses at random.
> 

Klez.e?
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html
I'm getting a bunch of infected mails here at work. Fortunately, we use 
Netscape mail. Don't need all the "features" of Outlook ;-).

> Currently I have recieved 3 different subjects all fromt he same system:
> Received: from imsp074.netvigator.com (imsp074.netvigator.com 
> [218.102.23.129])
> 
> Subjects so far:
> Subject: Is a registered trademark of Linus Torvalds
> Subject: Congratulations
> Subject: Re:bill,let's be friends   #the name will change as it is using the 
> address book of whoever is infected.
> 
> So far the spoofed addresses I have recieved are as follows:
> From: xcyber <xcyber at linux-sxs.org>
> From: submissions <submissions at linux-sxs.org>
> From: burns <burns at linux-sxs.org>
> From: langson <langson at pub.dgnet.gd.cn>
> From: doug <doug at linux-sxs.org>
> 
> Thos of you using Lookout/Express check your sent folder and update your 
> virsu scanners for the windoze boxen.  Not sure what all it does at this 
> point as I havent had time to dig into it.  Doug may be looking more into at 
> this point.
> 

AFAIK, if Outlook has been patched with all its security updates, the 
worm would not be able to spead (or it would at least require user 
permission). But don't quote me on that...

Tim