Another Virus- Lee Bailey Bailey & Associates E-Mail: [EMAIL PROTECTED] Phone: 954-659-1780 Fax: 954-659-1781 ----- Original Message ----- From: "Erin Bailey" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Tuesday, September 04, 2001 10:49 AM Subject: FW: ALERT: 2 virus signature updates this past weekend > > > Erin Bailey > > GoCruiseDirect.com > 8000 Governors Square Blvd., Suite 200 > Miami Lakes, FL 33016 > 305-819-3242 (ext 2105) > > > -----Original Message----- > > From: Steve Summerlin > > Sent: Tuesday, September 04, 2001 9:46 AM > > To: *A to Z - All Employees and Contractors > > Subject: ALERT: 2 virus signature updates this past weekend > > > > This week was busy for signature files. There were two updates over the > > weekend. Here is the latest. > > Win32/Apost.A.Worm > > Last Updated: September 03, 2001 > > > > Apost is a new binary worm that spreads through Microsoft Outlook that has > > been reported as spreading in the field by Computer Associates clients. > > > > The worm will arrive attached to an email with the subject: > > > > "As per your request!" > > > > and the body text: > > > > "Please find attached file for your review. I look forward to hear from > > you again very soon. Thank you." > > > > with the worm contained in the attachment: > > > > readme.exe > > > > Once activated, the worm will copy itself to the Windows directory and > > install itself as auto run in the registry: > > > > HKCU\Software\Microsoft\Windows\CurrentVersion\Run\macrosoft=<Windows > > Directory>\readme.exe > > > > The eTrust InoculateIT signature updates listed below contain specific > > detection for Win32/Apost.A.Worm. Files detected as Win32/Apost.A.Worm > > have to be deleted. This can either be done manually or by setting > > InoculateIT to delete infected files. > > > >
