FW: Virus info.

[Rankin, Robert L]

Dear Colleagues,

It looks as though one of the list members is indeed infected with the
"sobig.f" virus/worm.  Carolyn Quintero got a message with an attachment
from my email address, but I hadn't sent her anything.  I use the
University's antivirus software and they too filter all incoming email, so
apparently I'm not the one who is infected.  But someone with me and Carolyn
in their address book IS infected.  I asked KU about it and got the
following response.      Bob

-----Original Message-----
From: Doughty, Liz On Behalf Of KU Abuse Reporting
Sent: Wednesday, August 20, 2003 4:22 PM
To: Rankin, Robert L
Subject: RE: virus?

 These e-mails most likely come from a virus/worm. You are receiving these
messages because your e-mail address is in the e-mail addressbook of someone
who has been infected with one of several viruses that can produce e-mails
such as the ones you are receiving.

When these viruses execute, they gather all the e-mail addresses they can
find on the infected computer and secretly send infected messages to all but
one of those addresses. The virus then places that one, randomly chosen,
address in the From: field of all those infected outgoing messages (your
address, in this case). This is so that it will be difficult to determine
where the messages really came from, and also means that some innocent
person (you) will be wrongly accused. It does NOT mean that you are
infected.

The returned mail notices you are receiving look like they might be from
sobig.f, or one of several other worms that have similar behavior.
Information on most of the viruses that have been spotted at KU can be found
at http://www.ku.edu/acs/virus/moreviruses.shtml.

KU is scanning all incoming and outgoing mail for these and many other
viruses/worms, and we are asking that you DO NOT open any attachments that
you are not expecting.

If you are not running current anti-virus software and are affiliated with
KU, you may download KU's free anti-virus package from www.ku.edu/acs/virus.

I hope this answers your questions and puts your mind at least a bit at
ease.

KU Abuse Team


-----Original Message-----
From: Rankin, Robert L
Sent: Wednesday, August 20, 2003 3:54 PM
To: Abuse Reporting
Subject: FW: virus?

I have just today received a whole string of these "undeliverable" notices
from various persons I do not know and who are not on any list I am a member
of.  A friend in Colorado has gotten several too and says they contain the
"sobig" virus in their attachments.      R. Rankin