AUDITORY: Virus incident

[Dan Ellis <dpwe@xxxxxxxxxxxxxxx>]

Dear List -

As you will have noticed, it appears that one of our number was struck
by a variant of the infamous LOVEBUG virus, with the effect that the
virus was sent to the entire AUDTIORY list earlier this morning.  I'm
pleased to note that about 30 sites rejected the message outright via
filtering software in their mail gateways.  I'm hoping that the
remainder of readers were either immune (because, like me, they don't
read their mail with Microsoft Outlook), or had installed protection
after the original LOVEBUG outbreak.

The message to avoid is:

  Date: Thu, 2 Nov 2000 22:23:54 -0800
  From: jhershey@COGSCI.UCSD.EDU
  Attachment: LOQUSUPI.BMP.vbs

It's that vbs (Visual Basic Script?) attachment that's the real
culprit.

Unfortunately, being a non-Windows person, I don't understand very
much about this virus, but I believe it automatically forwards itself
to everyone on your personal email alias list.  The follow-up message
sent to AUDITORY contains some good advice.  I have also been pointed
to the following web sites:

  http://www.fsecure.com/v-descs/love.htm
  http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=VBS_LOVELETTER
  http://vil.nai.com/villib/dispVirus.asp?virus_k=98617

My understanding is that you are not in danger unless you are reading
your mail with a version of Microsoft Outlook AND you haven't made
modifications to disable the automatic execution of VBS scripts.

My deepest regrets for this situation.  There's not much we can do
short of installing commercial virus scans in the listserv itself,
which would probably be quite a technical challenge.  However, I am
hopeful this won't recur or become a significant problem.

-- DAn Ellis <dpwe@ee.columbia.edu> http://www.ee.columbia.edu/~dpwe/
   Dept. of Elec. Eng., Columbia University, New York NY 10027  (212) 854-8928