Sorry for he length of this but I felt it best to alert people and avoid any
worry or panic before it progresses even further.
The Office is currently being bombarded with computer viruses over the past
two days. In addition we have had literally hundreds of warnings from
third parties - many .ac.uk (i.e. University) addresses -
indicating that we have been responsible for sending these.
Thorough testing and time wasting has confirmed we do not have a virus and
have not sent or received any.
The reported virus concerned is consistently the W32.Sobig.F@mm worm. It
was only discovered by the antivirus companies on 18 August - Monday of this
week
Checking Norton antivirus website shows this is a benign, but time wasting
worm that just sends brief Subject and Body Text to people on the address
book - but it also artificially creates the FROM field from an infected
address book - so mimics coming from third parties. Apparently the writer
has built in that the action ceases on September 10.
Check out Norton-Symanetec or McAfee (or other) official websites for more
details - this is not a hoax.
Until September 10 then we may well see a spate of these infections and
complaints from third parties and there seems little we can do about it.
If you discover these please do not panic or be alarmed. We have Norton
fully active in the office - and up to date. So we are protected.
I can only assume that someone who has contacted us - has become infected
and is falsely sending out these viruses which are perpetuating in other
users without adequate and up to date virus protection - on home PCs or a
University link perhaps.
Norton antivirus updates of 19 August and McAfee data file 4287
(also 19 August) or above are needed to offer protection if you are attacked
or infected. It's NEW - whatever your protection, get it updated NOW.
There is an automatic removal tool available from the antivirus
suppliers sites if needed.
This will slow down email systems - and waste lot of time - I understand at
least one Hospital has discovered infection already in some PCs on their
network.
Don't panic - but take adequate and up to date precautions.
Please especially check out your home PCs to avoid problems.
I understand that JISCMAIL - this mailbase is protected by using MIMEDefang.
Best regards,
Graham
Dr Graham Groom
Senior Administrator
Association of Clinical Biochemists
130-132 Tooley Street, LONDON SE1 2TU
Phone: 020 7403 8001 Fax: 020 7403 8006
Website: www.ACB.org.uk or for our annual conference www.focus-ACB.org
For the more inquizzative -
TECHNICAL DETAILS OF THE VIRUS ARE -
===============================================
Subject may contain any of the following :
Your details
Thank you!
Re: Thank you!
Re: Details
Re: Re: My details
Re: Approved
Re: Your application
Re: Wicked screensaver
Re: That movie
Any Attachment may contain any of the following :
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif
The Body of text of the email may contain any of the following :
See the attached file for details
Please see the attached file for details
The "From:" address may be spoofed with an address extracted from the victim
machine. Therefore the perceived sender is most likely not a pointer to the
infected user.
=======================================================
------ACB discussion List Information--------
This is an open discussion list for the academic and clinical
community working in clinical biochemistry.
Please note, archived messages are public and can be viewed
via the internet. Views expressed are those of the individual and
they are responsible for all message content.
ACB Web Site
http://www.acb.org.uk
List Archives
http://www.jiscmail.ac.uk/lists/ACB-CLIN-CHEM-GEN.html
List Instructions (How to leave etc.)
http://www.jiscmail.ac.uk/
|
