Re: ALERT!!! Virus warning!

[Paul D. Robertson <proberts@clark.net>]

On Wed, 12 Jul 2000, Emil Tchomonev wrote:

> Does anybody have any suggestions about LIVE_STAGES.txt.SHS file???

There are detectors and cleaners out there, I think this one surfaced
about three weeks ago and escallated about two or three days out (maybe
around 6/20 cleaners were available.  If it's actually LIVE_STAGES and not
LIFE_STAGES, it may be a variant, in which case you'll need to check with
your AV vendor- however I'm not sure we've seen any major variants out of
Stages yet.  If you have good reason to think it's not the original Stages
worm, I'd appreciate a copy.

> I have found that this file was received many times by our mail server, and 
>this is usual behavior of mail worms. Unfortunately I couldn't find anything 
>written by AV companies.

Stages was fairly prevelant and spread a bit.  If it hadn't been in the
wake of the love stuff it'd have been a much more signifcant event, but
the AV vendors got stuff out very quickly.  Every major AV vendor that I
can think of had detection updates out almost immediately.  Cleaners
followed about 48-72 hours later.

> Does anybody have some points???

If you get a virus, update your AV vendor's signatures/products to the
latest ones and see if it detects it.  If it doesn't, contact your AV
vendor, they'll be able to help.

Some file-trapping products on NT had problems with .shs files because the
OS hides the extension from them, in that case you definitely need to talk
to the vendor.  Some Exchange-based things don't do well under heavy load,
in that case you also need to talk to the vendor.  

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."


-
[To unsubscribe, send mail to majordomo@lists.gnac.net with
"unsubscribe firewalls" in the body of the message.]