I just got a message from OAR.NET referring to a virus alert.  Still trying
to find out more about it, but I thought I would post this just in case.
Trying to find out more on this one to see if there is an attachment I can
block.


From: Jodi Santini [mailto:[EMAIL PROTECTED]]
Sent: Friday, January 04, 2002 1:07 PM
To: [EMAIL PROTECTED]
Subject: Virus Alert - W32/ShakerWorld


Posted on notice.oar.net 1/4/02:

Virus Alert:

There is a variation of the W32/ShakerWorld virus making its way around the
Internet.  We are have not found information on this virus at Symantec or
CERT yet, but this what we have learned thus far from our internal security
folks which you will want to watch out for on your networks:

o Random 8 char. file in the System directory
o Shake.exe in email (MassMailer)
o NetBIOS connections spreading virus to servers
o Registry entry 'sysinfo' under the run statement. Note that we are
    seeing variants in the name of the key sysinfo<random chars>

People who have been hit have gotten this virus thorugh email.  This virus
can install a key in the registry of the infected systems.

This is the information we have received at this time.

Thank You,

         Jodi



Pete Pfefferkorn
Senior Systems Engineer/Mail Administrator
University of Cincinnati
51 Goodman Street
Cincinnati, OH  45221
Phone - (513) 556-9076
Fax -     (513) 556-2042


_________________________________________________________________
List posting FAQ:       http://www.swinc.com/resource/exch_faq.htm
Archives:               http://www.swynk.com/sitesearch/search.asp
To unsubscribe:         mailto:[EMAIL PROTECTED]
Exchange List admin:    [EMAIL PROTECTED]

Reply via email to