I thought all of the list might be interested in how the
IEEE list server handles viruses, because the virus that
is currently being discussed, was NOT spread by the IEEE
listserver. The following is information on the virus,
how to clean off of your system (if you got it) and why
the server did not spread it.
1. Name of the virus and the file.
Name: Worm.ExploreZip(pack)
Aliases: W32/ExploreZip.worm.pak,
MiniZip Worm,
I-Worm.ZippedFiles,
W32/ExplorezipB
Known Variants: Worm.ExploreZip
Infection Length: 120,495 bytes
Area of Infection: C:\Windows\System\
File: zipped_files.exe
2. How our subscribers got infected.
Many Emc-pstc subscribers were infected because they posted
a message to the listserver and therefore their name and
e-mail address resided in one or more of our infected
subscribers' computers.
This was not a fault of either the listserver or the
subscriber. The virus used the received messages in the
infected subscribers e-mail to capture e-mail addresses. It
found a number of our subscribers in their e-mail address
and sent them the virus. The infected person had no idea
it was happening. The e-mail sent to the listserver bounced
back to the sender and was not distributed to the list.
3. Information about the virus:
http://www.sarc.com/avcenter/venc/data/worm.explorezip.pack.html
3. Virus fix can be downloaded from:
http://www.sarc.com/avcenter/kill_ez.html
4. How the IEEE listserver checks messages for viruses.
The IEEE e-mail server does a virus check on all incoming e-mail, not just
e-mail for the listserver. Anything containing a virus will bounce back to who
ever sent it. Also the emc-pstc has a maximum attached file size of 100k, which
also would have prevented it from being sent out even if it was new enough to
pass through the virus check. Just a note, if you are a IEEE member you can get
an IEEE e-mail alias (i.e. [email protected]). All of your e-mail that is
forwarded through the alias, will also go through the virus check.
5. Please also cease posting messages about this virus as we all
know it is there and everyone now knows how to eliminate it. As
this message will take hours to get to everyone, you will still
get a few messages about it, even if our subscribers stop with
this request.
One last note, even though my name is on this e-mail, Rich Nute
did most of the creation. I just modified it a little. Rich does
a lot of things behind the scene that only a few subscribers,
Ed Price, Roger Volgstadt and myself see. I certainly appreciate
the effort he puts forth on the maintenance of this list.
Jim
Jim Bacher, Senior Engineer
Paxar - Monarch
email:[email protected]
voice:1-937-865-2020
fax:1-937-865-2048
---------
This message is coming from the emc-pstc discussion list.
To cancel your subscription, send mail to [email protected]
with the single line: "unsubscribe emc-pstc" (without the
quotes). For help, send mail to [email protected],
[email protected], [email protected], or
[email protected] (the list administrators).
