Symantec released the new virus defs (9/18/01) that are supposed to catch
this.
Chuck Parkey
-----Original Message-----
From: Craig Manske [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 2:24 PM
To: Exchange Discussions
Subject: RE: New Virus / Worm ??
Trend finally came out with there pattern update. :( Luckly I didn't get it
anywhere.
> -----Original Message-----
> From: Heather Bellson [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, September 18, 2001 4:23 PM
> To: Exchange Discussions
> Subject: RE: New Virus / Worm ??
>
>
> woops, i should say that i'm talking about NAI's sdat.
>
> -----Original Message-----
> From: Heather Bellson [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, September 18, 2001 2:16 PM
> To: Exchange Discussions
> Subject: RE: New Virus / Worm ??
>
>
> the sdat version 2 deleted a bunch of executables on the
> three nt boxes we
> ran virus scan on. we had it set to automatically clean.
> iexplore.exe
> hyperterminal, etc. not good.
>
> anyone else seeing this?
>
>
> -----Original Message-----
> From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, September 18, 2001 12:16 PM
> To: Exchange Discussions
> Subject: RE: New Virus / Worm ??
>
>
> Yes, NAI released an extra.dat Still waiting for trend to put out an
> update.
>
> Pete Pfefferkorn
> Senior Systems Engineer/Mail Administrator
> University of Cincinnati
> 51 Goodman Street
> Cincinnati, OH 45221
> Phone - (513) 556-9076
> Fax - (513) 556-2042
>
>
> -----Original Message-----
> From: Etts, Russell [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, September 18, 2001 2:51 PM
> To: Exchange Discussions
> Subject: RE: New Virus / Worm ??
>
>
> Does anyone have any more info on this??
>
> Does NAI have an update? I can't get through to them.
>
> Thanks
>
> Russell
>
> -----Original Message-----
> From: John Bricher [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, September 18, 2001 12:33 PM
> To: Exchange Discussions
> Subject: RE: New Virus / Worm ??
>
>
> On the servers that were infected at our company, we found a
> mmc.exe that
> was running in c:\winnt. This appeared to be regenerating
> the readme.eml
> files. We killed the process, deleted the file, and deleted
> the .eml files.
> This appears to have worked for now.
>
> Not sure how to stop it from happening again.
>
>
> John Bricher
> Windows NT Engineer
> Cybear, Inc.
> 561-999-3549
> [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
