[pct-l] Admin Note: Swen worms and list members

[pct-l-adms at mailman.backcountry.net (PCT-L Admin)]

At 07:50 PM 9/23/03, JohnDRandall@aol.com wrote:
>Everyone take whatever precautions you need to, and I ask that the
>distribution list  be suspended for two weeks to test out the virus 
>infections.   We
>have too much to share to disband because of a virus.

PCT-L will not be suspended for two weeks. The software that runs the list 
does not allow attachments (non-text mime) so the worm cannot propagate via 
the list.

I got about 200Meg of Swen worms too, starting Sunday night, however NONE 
of the worms came through the list.

Like Sobig.f, Swen gets its list of addresses from the infected computer. 
These addresses can come from the Outlook mailbox, the Outlook address book 
or from the Internet Explorer Cache. (notice that these are all Micro$oft 
products...... The list is on a Unix Machine.)

That means that a list member maybe infected, or just someone who browsed 
the archives at http://www.backcountry.net/arch/pct/ and has the email 
addressed published there in their cache.

Unsubscribing from the list WILL NOT stop the infected computers from 
sending you copies of the worm.


--
Brick Robbins

The important things are always simple.
The simple things are always hard.