>Approved-By: [log in to unmask]
>X-Mailer: Internet Mail Service (5.5.2652.78)
>X-MIME-Autoconverted: from quoted-printable to 8bit by usilws21.ca.com id
> KAA07245
>Date: Tue, 13 Feb 2001 10:25:19 -0500
>Reply-To: [log in to unmask]
>Sender: [log in to unmask]
>From: enews <[log in to unmask]>
>Subject: InoculateIT Personal Edition AntiVirus Newsletter from Computer
> Associates, Version 01.05 February 13, 2001
>Comments: To: [log in to unmask]
>To: [log in to unmask]
>
>=============================================
>E-News: InoculateIT Personal Edition AntiVirus
>Newsletter from Computer Associates
>Version 01.05 | February 13, 2001
>via www: http://esupport.ca.com
>=============================================
>
>Table of Contents
>
>- VBS.VBSWG.J
> (also known as VBSWG.J, VBS.VBSWG.generic,
> VBS/SST, VBS/SST@MM, VBS/SST-A, VBS_Kalamar.A,
> Calamar, VBS.OnTheFly, and Anna Kournikova)
>
>- InoculateIT Personal Edition AntiVirus
> Update Number 1139 available
>
>==============================================
>VBS.VBSWG.J
>==============================================
>
>VBS/SST.Worm is a Visual Basic Script worm
>that spreads via e-mail by using the Microsoft
>Outlook application. Computer Associates has
>received many infection reports from clients
>in the USA and the UK.
>
>The virus arrives attached to an e-mail message
>that has the Subject line:
>
>"Here you have, ;o)"
>
>The message body contains the following text:
>
>"Hi:
>Check This!"
>
>The attachment to the e-mail message is a
>Visual Basic Script file named:
>
>"AnnaKournikova.jpg.vbs".
>
>When the attached program (the worm code) is
>executed, SST copies itself to the
>Windows directory. Then it creates its infection
>mark by adding the following registry key:
>
>"HKCU\software\OnTheFly\Worm made with Vbswg 1.50b"
>
>As a payload, on the 26th of January, it will
>launch a browser session to point to
>http ://www.dynabyte.nl.
>
>The worm then proceeds to send itself out to
>all addresses found in all Outlook Address Lists.
>A registry key will be created so the mass
>mailing payload will not be triggered again:
>
>"HKCU\software\OnTheFly\mailed", value set to 1.
>
>IPE signature update 1139 includes detection
>for VBS/SST.Worm.
>
>=============================================
>VIRUS UPDATE 1139
>=============================================
>
>The latest AntiVirus Update has been uploaded
>to the Computer Associates web site for you
>to download.
>
>To download the new signature files for IPE
>without going through your Web browser, you can
>use the new "Auto Download" feature inside
>IPE (Tools, AutoDownload) or the AutoDownload
>application to check for updated signatures,
>download, and install them.
>
>Alternatively, the update file can be obtained
>at the following URL:
>http://antivirus.ca.com/cgi-bin/ipe/update.cgi
>
>It is recommended that once you have downloaded
>and installed an update that you do a virus
>scan of all the files on your system and
>create a new reference disk for your system.
>
>We recommend that you keep your anti-virus
>protection up-to-date at all times by ensuring
>you are running the most up-to-date anti-virus
>software (Current IPE version 5.2) and that latest
>update kit.
>
>These update kits are cumulative: therefore the
>latest update kit includes everything from all
>previous update kits as well as the new virus
>information.
>
>These update kits are NOT complete versions of
>IPE but an update which will allow version 5.2
>to detect and clean the latest viruses.
>
>=============================================
>
>Additional information on viruses, worms, and
>Trojan can be found at Computer Associates
>Virus Information Center:
>http://www.ca.com/virusinfo/
>
>Carnegie Mellon Software Engineering Institute
>(CERTŪ Coordination Center):
>http://www.cert.org/advisories/
>
>=============================================
>
>To subscribe to this or other newsletters, go
>to http://esupport.ca.com/index.html?ENews.
>
>You can unsubscribe from the same E-News page or
>by sending an email to mailto:[log in to unmask]
>with 'signoff enews_ipe' in the message body.
>
>This newsletter contains practical tech support
>information about relevant issues with our
>products.
>
>=============================================
>
>Feedback? Comments? Suggestions?
>Send mailto:[log in to unmask] All submissions
>become the property of the publisher and may or
>may not be reprinted.
>
>NOTE: This address should be used only for
>feedback on this newsletter. Requests for
>technical support should be submitted through
>normal channels.
VICUG-L is the Visually Impaired Computer User Group List.
To join or leave the list, send a message to
[log in to unmask] In the body of the message, simply type
"subscribe vicug-l" or "unsubscribe vicug-l" without the quotations.
VICUG-L is archived on the World Wide Web at
http://maelstrom.stjohns.edu/archives/vicug-l.html
|
