Subject: RE: email virus? [[email-masked]: FVWM: MIME-Version: 1.0]

From: "Steffl, Erik" <[email-masked]>
Date: Mon, 7 Feb 2000 14:01:01 -0600

I use win nt (and solaris via exceed (win nt X server)) and the script
caused some error in internet explorer. I don't see any damage (but I did
not really checked anything, just ran the antivirus, the system works fine
for now)...

  anyway, this prompted me to turn of all java/javascript/activeX etc
features in outlook... feel better now.

	erik

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Matthew W. Roberts
> Sent: Monday, February 07, 2000 8:45 AM
> To: [email-masked]
> Subject: email virus? [[email-masked]: FVWM: MIME-Version: 1.0]
> 
> 
> I've gotten two messages from:
> 
> [email-masked]
> 
> with the subject:
> 
> FVWM: MIME-Version: 1.0
> 
> that have come through the fvwm mailing list.  The message has an
> attached HTML file with some fairly cryptic javascript.  I didn't
> take the time to really get into it, but it looked like it was set
> to delete files and mess with the Windows registry.
> 
> Makes me glad I don't use windows.  Makes me wonder why someone would
> send it to the FVWM list.
> 
> 
> 
> --
> Matthew W. Roberts
> ----------------------------------------------------------------
> Structural Engineering                              [email-masked]
> Texas A&M University                        
> ----------------------------------------------------------------
> -
> Any fool can criticize, condemn and
> complain and most fools do.
>    -- Benjamin Franklin
> 
> 
> --
> Visit the official FVWM web page at <URL: http://www.fvwm.org/>.
> To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
> message to [email-masked].
> To report problems, send mail to [email-masked].
> 
--
Visit the official FVWM web page at <URL: http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].

---

From: Mark Crocker <[email-masked]>
Date: Wed, 9 Feb 2000 15:09:38 -0700 (MST)

FYI:

I forwarded this information onto our local virus team and they found
that the virus is virtually unknown by the antivirus establishment (at
least as of yesterday morning).  They did, however, discover that it
has been reported on alt.comp.virus and is called
W32Script/Unicle.worm.  Apparently, it copies various system files to
a public ftp site, appends itself to all outgoing email messages and
possibly damages the registry... if you're using Microsoft Outlook on
a Microsoft Windows platform AND you don't have the security features
set correctly.

Naturally, I'm not going to disclose the status of our local efforts
to deal with this virus, but I thought the rest of you, especially
Erik, might want to know that there was no antivirus software that can
detect it as of yesterday and that it can send confidential
information to a public site.  If there is a virus software update
available for it in the future, you should be able to find it under
the keyword "Unicle".

On Mon, 7 Feb 2000 14:01:01 -0600 , "Steffl, Erik" <[email-masked]> wrote:

> caused some error in internet explorer. I don't see any damage (but
> I did not really checked anything, just ran the antivirus, the
> system works fine for now)...

>> -----Original Message----- From: [email-masked]
>> [mailto:[email-masked]]On Behalf Of Matthew W. Roberts Sent:
>> Monday, February 07, 2000 8:45 AM To: [email-masked] Subject: email
>> virus? [[email-masked]: FVWM: MIME-Version: 1.0]
>>
>>
>> Makes me glad I don't use windows.  Makes me wonder why someone
>> would send it to the FVWM list.
>>
>>
>>
>> -- Matthew W. Roberts
>> Structural Engineering [email-masked] Texas A&M University
>> ---------------------------------------------------------------- -
>> Any fool can criticize, condemn and complain and most fools do.
>> -- Benjamin Franklin
>>
>>
>> -- Visit the official FVWM web page at <URL: http://www.fvwm.org/>.
>> To unsubscribe from the list, send "unsubscribe fvwm" in the body
>> of a message to [email-masked].  To report problems, send mail
>> to [email-masked].
>>
> -- Visit the official FVWM web page at <URL: http://www.fvwm.org/>.
> To unsubscribe from the list, send "unsubscribe fvwm" in the body of
> a message to [email-masked].  To report problems, send mail to
> [email-masked].

-- 
-------------------------------------------------------------------------------
 Mark Crocker (MTI PE) | [email-masked] | (208) 36-83525 | Pg. 99416
		 http://markcrocker.micron.com/~mcrocker
-------------------------------------------------------------------------------
--
Visit the official FVWM web page at <URL: http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].