Christian,

Have a read of the following. It looks as if you have been bitten by it as
you have sent it to the HP3000-L.

regards,
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Robert W.Mills (Systems Development Manager) |
|Windsong Services, St. Mary Cray, ENGLAND    |
|Tel  : +44 (0)1689 870622 x3005              |
|Fax  : +44 (0)1689 899026                    |
|Email: [log in to unmask]  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

-----Original Message-----
From: enews [mailto:[log in to unmask]]
Sent: Thursday, May 10, 2001 6:11 PM
To: [log in to unmask]
Subject: InoculateIT Personal Edition AntiVirus Newsletter from Computer
Associates, Version 01.13 May 10, 2001


=============================================
E-News: InoculateIT Personal Edition AntiVirus
Newsletter from Computer Associates
Version 01.13 | May 10, 2001
via www: http://esupport.ca.com
=============================================

Table of Contents

- VBS/VBSWG.X.Worm
  (also known as VBS.Homepage)

- InoculateIT Personal Edition AntiVirus
  Update Number 1205 available

==============================================
VBS/VBSWG.X.Worm (also known as VBS.Homepage)
==============================================

VBS/VBSWG.X.Worm

VBSWG.X is a new e-mail worm spreading through
Microsoft Outlook and is yet another variant
generated by the VBS Worm Generator Kit.

The worm arrives as a message with the Subject
line:

"Homepage"

and the message body:

"Hi!
You've got to see this page! It's really cool ;O)"

The attached file, which contains the worm code,
is named:

"HOMEPAGE.HTML.VBS"

When the attached code is executed, VBSWG.X
saves a copy of its code to the Temp directory
and then mails itself out to all recipients
listed in all address books.

Once the mailing procedure is completed, the
worm modifies the registry entry (sets it to
1):

HKEY_CURRENT_USER\Software\An\mailed

Next, the worm browses through the Inbox and
Deleted Outlook folders and deletes all
messages with the same Subject line as the
worm's one ("Homepage").

Finally, VBSWG.X uses a default Web browser
to open one of four pornographic web sites.

=============================================
VIRUS UPDATE 1205
=============================================

The latest AntiVirus Update has been uploaded
to the Computer Associates web site for you
to download.

To download the new signature files for IPE
without going through your Web browser, you can
use the new "Auto Download" feature inside
IPE (Tools, AutoDownload) or the AutoDownload
application to check for updated signatures,
download, and install them.

Alternatively, the update file can be obtained
at the following URL:
http://antivirus.ca.com/cgi-bin/ipe/update.cgi

It is recommended that once you have downloaded
and installed an update that you do a virus
scan of all the files on your system and
create a new reference disk for your system.

We recommend that you keep your anti-virus
protection up-to-date at all times by ensuring
you are running the most up-to-date anti-virus
software (Current IPE version 5.2) and that latest
update kit.

These update kits are cumulative: therefore the
latest update kit includes everything from all
previous update kits as well as the new virus
information.

These update kits are NOT complete versions of
IPE but an update which will allow version 5.2
to detect and clean the latest viruses.

=============================================

Additional information on viruses, worms, and
Trojan can be found at Computer Associates
Virus Information Center:
http://www.ca.com/virusinfo/

Carnegie Mellon Software Engineering Institute
(CERTŪ Coordination Center):
http://www.cert.org/advisories/

=============================================

To subscribe to this or other newsletters, go
to http://esupport.ca.com/index.html?ENews.

You can unsubscribe from the same E-News page or
by sending an email to mailto:[log in to unmask]
with 'signoff enews_ipe' in the message body.

This newsletter contains practical tech support
information about relevant issues with our
products.

=============================================

Feedback? Comments? Suggestions?
Send mailto:[log in to unmask]  All submissions
become the property of the publisher and may or
may not be reprinted.

NOTE:  This address should be used only for
feedback on this newsletter.  Requests for
technical support should be submitted through
normal channels.

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *