A new worm - I don't think I've received it, but in case I have, or any of you have, here's some info. -Pam -----Original Message----- From: Kusse, James Sent: Tuesday, December 04, 2001 4:40 PM To: Laing, Kevin M; Saturno, Anthony; Bhat, Archana; Davis, Erica P; Kusse, James; Mohan, Jatin; Hassam, Jeanine M; Drury, Jennifer; Dudek, Joe; Flynn, Kevin; Chung, Lorna; Falcone, Matt; Memed, Nurachman; Stevenson, Pam; Cumberland, Paul; Robinson, Philip L; Jagannathan, Priya; Sreenivasan, Raghavaperumal; DiRenzo, Rita; Hayes, Robert C; Janapareddi, Savithri; Johnson, Stuart; O'Connor, Terry; Pease, Thomas M; Suhr, Thomas E; Kanakam, Venkat; Morrow, Clark; Batten, Jim; Wood, Peter J; Feeney, Bob; Discavage, Tim Subject: FW: W32/GoneA@mm -- Virus Has Entered Xerox Environment Importance: High To all XESIM employees and contractors - PLEASE READ BELOW!!!!!! DO NOT OPEN THE ATTACHMENT INCLUDED WITH ANY MAILING THAT HAS THE FOLLOWING...... Subject: Hi Body: How are you ? When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it! Attachment: GONE.SCR Again please read below. Jim Kusse Enterprise Systems Management, EDS 300 Main St. MS 898/01A East Rochester, NY 14445 phone: 716-231-7265 Cell Phone: 734-5191 [log in to unmask] <<...OLE_Obj...>> The W32/Goner@MM virus has found its way into the Xerox environment even though we are blocking .SCR files at the Internet gateways and PMDF switches. This mass mailing worm attempts to send itself using Microsoft Outlook to all entries found in the Outlook Address book. It tries to delete security software, can spread via ICQ, and contains a DDoS payload via IRC. Please notify IM personnel in your organizations to take immediate actions to mitigate the propagation of this virus by deploying the EXTRA.DAT or SUPER EXTRA.DAT files that NAI has made available. A description of this virus and the emergency DAT files are available at: http://vil.nai.com/vil/virusSummary.asp?virus_k=99272 Thanks, Bob -----Original Message----- From: Polisseni, Bob Sent: Tuesday, December 04, 2001 11:22 AM To: USA CIS Virus Communications Subject: W32/GoneA@mm -- Virus Alert Importance: High A new virus threat is "in the wild". Not much is known about this yet. It appears that the attachments that are being seen are for a new worm known as [log in to unmask] EDS is adding filtering for this virus at Internet Gateways and on the PMDF switches for the attachment Gone.scr. NAI is "aware of this virus, and is starting to gather information on it" and will get some information to Xerox as soon as possible. In case you are not aware, SOPHOS just issued an EMERGENCY alert, indicating that it is "spreading widely in the wild": http://www.sophos.com/virusinfo/analyses/w32gonera.html Profile on FSecure: http://www.datafellows.fi/v-descs/goner.shtml More details will be sent to you once we know what we are dealing with and when additional information is received from NAI. Thanks, Bob Bob Polisseni Corporate Information Security Virus Protection Support * Phone: 716.423.8629 8*223.8629 * Fax: 716.423.2759 * [log in to unmask] For information on CIS see the following site: http://xww.internal.xerox.com/security/