I received about 10 of these yesterday which my virus scanner didn't flag as
a virus. This morning it trapped 132 of them which it couldn't repair and I
had to deal with one at a time. I identified it as worm.automat.ahb but
there is no additional information.

----- Original Message -----
From: "J Dunlop" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Friday, September 19, 2003 4:29 AM
Subject: [HP3000-L] OT: Virusii and MS Updates


| Just fyi, this morning I received in my personal email, 34 (yes, 34)
| messages from my provider informing me that I had received a virus
| (they were HTML/Iframe_Exploit and Win32/Swen). I also received three
| emails from "MS" which contained extremely authentic looking content
| urging me to run the attachment to counter all known viruses! (Notice
| the lowercase "t" at the beginning of the email).
|
| "this is the latest version of security update, the "September 2003,
| Cumulative Patch" update which resolves all known security
| vulnerabilities affecting MS Internet Explorer, MS Outlook and MS
| Outlook Express as well as
|  three newly discovered vulnerabilities. Install now to help protect
| your computer from these vulnerabilities, the
|  most serious of which could allow an attacker to run executable on
| your computer. This update includes the
|  functionality of all previously released patches."
|
| However, the three emails all had different subject lines and "from"
| addresses. Subject 1 was "Current Security Update" from "Microsoft
| Security Center", subject 2 was "Network Critical Update" from
| "Microsoft Corporation Program Security Center" and the third one was
| "Internet Pack" from "Microsoft Corporation Technical Assistance".
| Needless to say, I did not execute any attachments but just wanted to
| highlight how convincing this presentation is and I can quite
| understand how many users would be tricked into executing the
| attachment and therefore proliferating a virus or two!
|
| Cheers,
|
| John Dunlop
|
| E-mail : [log in to unmask]      "If at first you don't succeed..
| Web : http://www.hp3000links.com    Don't take up sky-diving !"
| "All your HP e3000 resources on the Net"
| (Mirror: http://www.users.totalise.co.uk/~jdunlop/index.html)
|
| * To join/leave the list, search archives, change list settings, *
| * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
|

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *