[Coral-List] Coral-list has not transmitted latest worms or viruses.

Louis Florit Louis.Florit at noaa.gov
Thu Aug 21 13:23:05 EDT 2003


Dear Listers, I want to reiterate that the coral-list server has not 
sent out any viruses or worms; if you have recieved any viruses that 
appear to  come from coral-list at coral.aoml.noaa.gov, or 
jch at coral.aoml.noaa.gov, these are likely spoofed; infected computers 
are falsifying the email headers by picking random addresses and sending 
virused emails out themselves.

You can verify what computer sent the virus by examining the message 
email headers.  The 'Received:' line of the header will have something 
like this (an actual example of spoofing the message as if 
coral-list-bounces at coral.aoml.noaa.gov is sending the virused message):

Received: from CORAL-AVENGERS (bis5854.fiu.edu [131.94.35.215])
         by coral.aoml.noaa.gov (Postfix) with ESMTP id 7F19F177FD
         for <coral-list-bounces at coral.aoml.noaa.gov>; Wed, 20 Aug 2003
         14:31:55 +0000 (UTC)

The above header was generated by a lab computer at Florida 
International University that is infected with the virus; that system 
has since been isolated.  However, other computers on the internet 
continue to be infected and send out messages as if they were from the 
coral-list.

The coral-list traffic is being emergency moderated, meaning that all 
messages will be examined and approved before being posted to prevent 
further warning messages from going out to the list.

The coral-list server itself has blocked over 520 virused messages 
submitted to the list over the past couple of days.

Again, please examine the following website for details on the SoBig 
virus' behaviour and update your virus scanners.

http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html

The Blaster worm works through a different avenue of attack and does not 
come across in email messages.  However, if your computer uses XP, or 
Windows 2000, I strongly suggest you run the Windows update function to 
protect your system from the Blaster worm.

If you have any questions, please contact me.

Louis
coral-list Tech Admin
-- 
Louis Florit, Research Associate
University of Miami/CIMAS
NOAA/Atlantic Oceanographic Meteorological Laboratory
4301 Rickenbacker Causeway
Miami, FL 33149
Phone:  (305) 361-4445




More information about the Coral-List mailing list