Subject: [idn] Nimda virus information

From: David Hopwood <[email-masked]>
Date: Wed, 07 Nov 2001 10:12:30 +0000

-----BEGIN PGP SIGNED MESSAGE-----

Two of the recent mails to this list (from <[email-masked]>, subject
"ip", and from <[email-masked]>, long subject line starting with
"8 readings") contained the Nimda virus - W32/Nimda.E, I think.

It propagates using Microsoft Outlook and IE. If you were infected, see

<http://securityresponse.symantec.com/avcenter/venc/data/[email-masked]>

<http://www.cert.org/advisories/CA-2001-26.html> (note that this describes
an earlier version of Nimda)

<http://www.microsoft.com/technet/treeview/default.asp?
url=/technet/security/bulletin/MS01-020.asp>

(or <http://www.microsoft.com/technet/treeview/default.asp?
url=/technet/security/bulletin/MS01-027.asp>, which incorporates the
same fix to IE.)

... and to solve the problem more thoroughly, stop using Outlook and IE.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---

From: "David Leung" <[email-masked]>
Date: Wed, 7 Nov 2001 10:59:59 -0500

Hi David,

Thanks for the info, I have successfully remove the virus from my machine
already but I was infected by opening the mail that yves post to this
mailing list.

Shouldnt this mailing list be virus scanned already? Instead of having this
post having the possiblility of infecting everyone on the list.

Thanks,
David Leung
Chief Technology Officer, Neteka Inc.
http://www.neteka.com
v: 416-971-4302
[email-masked]

----- Original Message -----
From: "David Hopwood" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, November 07, 2001 5:12 AM
Subject: [idn] Nimda virus information

> It propagates using Microsoft Outlook and IE. If you were infected, see
<http://securityresponse.symantec.com/avcenter/venc/data/[email-masked]
val.tool.html>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.3i
> Charset: noconv
>
> iQEVAwUBO+kI3jkCAxeYt5gVAQGVvggApUjQytbxjgaQkubx+BwTTLmCmsWiPa/J
> Wv9MIk3Zv5JtLsN0sO0b3pWgubsSI2NzHjd2we+A/vFYFz1JMWPsrTDg2pQpJ/w3
> pFYgKsX4tUN2lnlkxWpDa4gx4/qzyeWysU9W9uaHOq/sK1A54ARts7xPZX504c7x
> uZfq73z6ddPpr20H0sFeITlwWBt77jdAFEfFB6Aga03rogBESOpC6/D/hKGv1d0Y
> 4Dabux1w2zNvC8an+TfTRbBzsZRGYkpr+TGgfgrXBsgoCpta6auk0KyR4XDiAMEZ
> q9t9ki2nVyiiWTKIYpRe7gKim058qws+NNDGJVnegJh6LyMefCUpnQ==
> =rDRB
> -----END PGP SIGNATURE-----
>