PDA

View Full Version : virus problems



Ton Van Den Bogert
05-22-2002, 05:10 AM
Dear subscribers,

Biomch-L is certainly not the appropriate medium for virus alerts, but in
this case, after watching it for several weeks, there seems to be no
alternative.

Some of you have repeatedly received copies of the so-called Klez
virus. Often, the virus appears to come from another Biomch-L
subscriber. The virus has tried many times to post itself to Biomch-L,
but fortunately Biomch-L automatically blocks attachments. So there is
absolutely no risk that it spreads via Biomch-L postings. Instead, it
has spread through the Biomch-L community using our addressbooks that
represent (in Rodger Kram's words) a "tangled web" of personal contacts.

First of all, you can only be infected if you use a PC with a Microsoft
mail reader (Outlook etc). as your mail reader. Netscape is not vulnerable
to this particular mode of transmission, and neither are Macs. If you are
among the vulnerable, please read on.

The Klez virus takes a random pair of addresses from an infected computer's
addressbook, and sends itself to one address while using the other as a faked
sender's address. This explains why complaining to the "sender" never does
any good.

It is almost certain that there are one or more infected Biomch-L subscribers.
Only a Biomch-L subscriber's addressbook would contain certain combinations of
addresses that have been used by the virus.

I think it would be a good idea for all Outlook users among the Biomch-L
subscribers to check their computer for this virus. Look at the "symptoms"
section in http://vil.nai.com/vil/content/v_99455.htm . If found, please
remove the virus and install the IE security update.

If not removed, it will keep sending itself to people (and lists) in your
address book, while never identifying you as the sender (so nobody will even
tell you that you have a virus...).

If the virus (on someone else's computer...) happens to use your address as
"sender" while sending itself to the Biomch-L address (biomch-l@nic.surfnet.nl),
you will receive an automatic rejection message, complaining about a posting
with attachment. Please ignore this, it means that the protection against
attachments is working.

If the virus similarly uses your address to send itself repeatedly to the
LISTSERV address, (listserv@nic.surfnet.nl), LISTSERV may decide to no longer
reply to your e-mails because it thinks you make too many syntax errors. Let
me know if you suspect that this has happened.

If you have read this far, I apologize for the length of this posting.

Regards,

--

Ton van den Bogert, Biomch-L co-moderator

---------------------------------------------------------------
To unsubscribe send SIGNOFF BIOMCH-L to LISTSERV@nic.surfnet.nl
For information and archives: http://isb.ri.ccf.org/biomch-l
---------------------------------------------------------------