-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of enews Sent: Friday, May 05, 2000 3:43 PM To: [EMAIL PROTECTED] Subject: AntiVirus / AV-alert Newsletter from Computer Associates, Version 00.32 May 5, 2000 ============================================= E-News: AntiVirus / AV-alert Newsletter from Computer Associates Version 00.32 | May 5, 2000 Via www: http://support.ca.com ============================================= Table of Contents - VBS/LoveLetter.Variant. Worm - SP4 for InoculateIT 4.5 for NetWare supports NetWare 5.1 ============================================= VBS/LoveLetter.Variant. Worm ============================================= VBS/LoveLetter.Variant VBS/LoveLetter.Variant is a generic detection for minor variants of the original VBS/LoveLetter.Worm series of infections. "Mother's Day" is one such popular variant detected as VBS/LoveLetter.Variant. The subject used by the Mother's Day variant is "Mothers Day Order Confirmation" instead of the original "ILOVEYOU" subject line. The name of the attachment is mothersday.vbs instead of LOVE-LETTER-FOR-YOU.TXT.vbs. The HTML file sent through IRC is called "mothersday.HTM" instead of LOVE-LETTER-FOR-YOU.HTM. The four URL's have also changed: "http://www.hackers.com" "http://www.l0pht.com" "http://www.2600.com" "http://www.hackers.com" Instead of overwriting .JPG and .JPEG files, this variant is set to overwrite .INI and .BAT files which results in more severe damage to the infected system. This variant will not download the file WIN_BUGFIX.exe which is confirmed to be a password stealing trojan. For more information on VBS/LoveLetter infections, go to http://www.ca.com/virusinfo/virusalert.htm#love_letter InoculateIT signature update 11.17 detects the "Mother's Day" variant as "VBS/LoveLetter.Variant". VBS must be included in the list of file types to be scanned for the detection to work. In order to clean an infected system, InoculateIT must be run with action on infection set to delete files. ============================================= SP4 for InoculateIT 4.5 for NetWare ============================================= SP4 of InoculateIT 4.5 for NetWare will bring you up to Build 205 which is the NetWare 5.1 certified build. Installation requires that either Inoculan OR InoculateIT for NetWare be on the server already. You can download the service pack at: ftp://ftp.ca.com/pub/inoculan/InpackNW4.zip ============================================= Additional information on viruses, worms, and Trojan horses can be found at Computer Associates Virus Information Center: http://www.ca.com/virusinfo/ For more detailed virus information and specialized removal instructions, visit: http://www.ca.com/virusinfo/virusalert.htm Carnegie Mellon Software Engineering Institute (CERT� Coordination Center): http://www.cert.org/advisories/ ============================================= To subscribe to this newsletter, provide your email address on our website: http://support.ca.com/listserv/ Note: This newsletter, published as needed, provides up-to-date notification of virus outbreaks, virus signature updates, and other related technical support issues with our antivirus products. To unsubscribe, send mailto:[EMAIL PROTECTED] with 'signoff enews_avalert' in the message body. ============================================= Feedback? Comments? Suggestions? Send mailto:[EMAIL PROTECTED]. All submissions become the property of the publisher and may or may not be reprinted. NOTE: This address should be used only for feedback on this newsletter. Requests for technical support should be submitted through normal channels. ********************************************************** To unsubscribe from this list, send mail to [EMAIL PROTECTED] with the following text in the *body* (*not* the subject line) of the letter: unsubscribe gnhlug **********************************************************
