Worm alert: BEWARE of ALL attachments ending in ".vbs"

[Hope Ehn Dennis Ehn <ehn...>]

NOTE: The "FW:" in the subject line stands for "Forward." You will see it
in ALL forwarded mail that has been forwarded more than once, even
innocent text messages. So that in itself doesn't mean anything except to
proceed with caution, and avoid opening any attachments. 

Attachments can be dangerous. These new dangerous attachments share a
characteristic -- the file name ends with ".VBS" or ".vbs". This refers to
a "Visual Basic Script" file, which could be programmed to do things to
your computer. NEVER open *anything* arriving by E-mail with a file name
ending ".vbs". Some of these viruses have contained *multiple extensions*,
such as "filename.txt.vbs". These are, indeed, dangerous Visual Basic
Script files. 

If you are running Microsoft E-mail programs such as Outlook, you need to
be *extra* careful. Set your software so that it neither opens nor
"previews" *any* attachments. 

Hope Ehn             <ehn (at) world(dot)std(dot)com>

---------- Forwarded message ----------
Date: Fri, 19 May 2000 12:26:06 -0400
From: Rigbie Turner
To: MLA-L (at) LISTSERV(dot)INDIANA(dot)EDU
Subject: Worm alert

Our Network Administrator just sent this message to the staff of the
Morgan Library: 

A really nasty variant of the ILOVEYOU worm is sweeping the world today. 
Like ILOVEYOU and its previous copy cats the danger comes from attached
files. I strongly urge everyone to be highly suspicious of all attached
files, no matter who they're coming from. Before you open any attached
file, make sure you are expecting it, and that the sender has adequately
described the contents of the file and the file's name in the body of the
message. Also, all these worms have attached files with file extensions
that end in *.vbs.  So make sure that the attachment isn't a *.vbs file.
(That stands for Visual Basic Script.)

Here are the specific details of this new worm from the Symantec web site: 

Subject of e-mail: Variable; "FW: filename.ext" (where filename.ext is
                   derived from the user's recently opened documents
                   list). 
Name of attachment: Variable; "filename.ext.vbs" (where filename.ext is
                    derived from the user's recently opened documents
                    list). 
Size of attachment: Variable
Target of infection: Overwrites all files that are not currently in use
                     regardless of extension. 

Shared drives: Will overwrite files on all mapped local drives (with the
               exception of files in root directories). 

Rigbie Turner
Mary Flagler Cary Curator of
  Music Manuscripts and Books
The Pierpont Morgan Library
29 East 36th Street
New York, NY  10016-3403


---------------------- jewish-music (at) shamash(dot)org ---------------------+