[Coral-List] Coral-list has not transmitted latest worms or viruses.
Louis Florit
Louis.Florit at noaa.gov
Thu Aug 21 13:23:05 EDT 2003
Dear Listers, I want to reiterate that the coral-list server has not
sent out any viruses or worms; if you have recieved any viruses that
appear to come from coral-list at coral.aoml.noaa.gov, or
jch at coral.aoml.noaa.gov, these are likely spoofed; infected computers
are falsifying the email headers by picking random addresses and sending
virused emails out themselves.
You can verify what computer sent the virus by examining the message
email headers. The 'Received:' line of the header will have something
like this (an actual example of spoofing the message as if
coral-list-bounces at coral.aoml.noaa.gov is sending the virused message):
Received: from CORAL-AVENGERS (bis5854.fiu.edu [131.94.35.215])
by coral.aoml.noaa.gov (Postfix) with ESMTP id 7F19F177FD
for <coral-list-bounces at coral.aoml.noaa.gov>; Wed, 20 Aug 2003
14:31:55 +0000 (UTC)
The above header was generated by a lab computer at Florida
International University that is infected with the virus; that system
has since been isolated. However, other computers on the internet
continue to be infected and send out messages as if they were from the
coral-list.
The coral-list traffic is being emergency moderated, meaning that all
messages will be examined and approved before being posted to prevent
further warning messages from going out to the list.
The coral-list server itself has blocked over 520 virused messages
submitted to the list over the past couple of days.
Again, please examine the following website for details on the SoBig
virus' behaviour and update your virus scanners.
http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html
The Blaster worm works through a different avenue of attack and does not
come across in email messages. However, if your computer uses XP, or
Windows 2000, I strongly suggest you run the Windows update function to
protect your system from the Blaster worm.
If you have any questions, please contact me.
Louis
coral-list Tech Admin
--
Louis Florit, Research Associate
University of Miami/CIMAS
NOAA/Atlantic Oceanographic Meteorological Laboratory
4301 Rickenbacker Causeway
Miami, FL 33149
Phone: (305) 361-4445
More information about the Coral-List
mailing list