Return-Path: <[EMAIL PROTECTED]> Received: from mailserver2.Princeton.EDU ([128.112.128.25]) by imap2.Princeton.EDU (Netscape Messaging Server 4.15) with SMTP id GM1B6G00.LSR; Tue, 30 Oct 2001 14:51:52 -0500 Received: from smtpserver1.Princeton.EDU ([128.112.129.14]) by mailserver2.Princeton.EDU (NAVGW 2.5.1.6) with SMTP id M2001103014515130115 ; Tue, 30 Oct 2001 14:51:51 -0500 Received: from lists.Princeton.EDU (lists.Princeton.EDU [128.112.129.249]) by smtpserver1.Princeton.EDU (8.9.3/8.9.3) with ESMTP id OAA04212; Tue, 30 Oct 2001 14:51:48 -0500 (EST) Received: (from server@localhost) by lists.Princeton.EDU (8.9.1/8.9.1) id OAA14989; Tue, 30 Oct 2001 14:51:37 -0500 (EST) Received: from smtpserver1.Princeton.EDU (smtpserver1.Princeton.EDU [128.112.129.65]) by lists.Princeton.EDU (8.9.1/8.9.1) with ESMTP id OAA14936 for <[EMAIL PROTECTED]>; Tue, 30 Oct 2001 14:50:51 -0500 (EST) Received: from [128.112.234.196] (witsend-again.Princeton.EDU [128.112.234.196]) by smtpserver1.Princeton.EDU (8.9.3/8.9.3) with ESMTP id OAA03653; Tue, 30 Oct 2001 14:50:49 -0500 (EST) Message-Id: <[EMAIL PROTECTED]> Date: Tue, 30 Oct 2001 14:48:18 -0500 Reply-To: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] From: Rita Seplowitz Saltz <[EMAIL PROTECTED]> To: Office of Information Technology Staff <[EMAIL PROTECTED]> Subject: New version of Nimda worm - attachment "sample.exe" Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-To: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]> X-Listprocessor-Version: 8.1 -- ListProcessor(tm) by CREN
Greetings. I regret to inform you that a new version of the Nimbda worm is at work. The Symantec document is at: http:[EMAIL PROTECTED] This version, W32.Nimbda.E@mm, has an attachment called sample.exe. The ..dll file is called Httpodbc.dll. And it copies itself to the Windows system folder as Csrss.exe instead of Mmc.exe. Apart from that, its function is like the original and its subsequent variations. The OIT Help Desk has seen two mailings apparently generated by this version of Nimda. Please be alert--and if there are Windows users you know or assist who do manual updates of their anti-virus software, encourage them to update today and continue to update often. Thanks for your attention. Rita **************************************************************** This mail is generated from JOYnet, a Jesus Youth mailing list. To unsubscribe, send a mail to [EMAIL PROTECTED] To subscribe to this mailing list, visit http://www.jesusyouth.org/joynet For automatic help, send a mail to [EMAIL PROTECTED] In case of any issue related to the mailing list contact [EMAIL PROTECTED] ****************************************************************
