|
Sender: |
|
Subject: |
|
From: |
|
Date: |
Thu, 17 Jan 91 14:21:34 EST |
In-Reply-To: |
Message of Wed, 16 Jan 91 08:59:57 TUR from <ESRA@TREARN> |
Comments: |
|
Reply-To: |
|
Good advice, for more reasons than simply supressing propagation of
virusware.
----------------------------Original message----------------------------
On Wed, 16 Jan 91 08:59:57 TUR you said:
>Sorry for the cross postings.. A new virus is detected. The name is
>GAME2 MODULE sometimes seen as TERM MODULE..
>Our system got it from TRMETU and it seems that it is distributed
>by a LISTSERV.
The identification of LISTSERV as a vector for this worm is partially
a red herring. What happens is this:
A user runs the worm. If he happens to have a nickname in his NAMES
file that points at a Listserv mailing list, it will send a copy to
the list address.
Listserv then receives the file, and if the list is set up with the
'Files = Yes' attribute, it distributes the file to the list.
Moral of the story: All Listserv managers should carefully evaluate
the need for 'Files = Yes' on their lists.
Valdis Kletnieks
Computer Systems Engineer
Virginia Polytechnic Institute
|
|
|