Security Alert: New Virus Producing Large Volume of Spam E-Mails (5/16/05)
A new computer virus that was released over the weekend has resulted in a very large number of spam e-mail messages being delivered to the members of the Cornell community. The messages are a combination of text and web links pertaining to German politics and are for the most part in German.
Please note that these are simple e-mail messages. They do not contain a virus and put your system at no risk. You can simply delete the message.
In all of these messages, the "From" line is a forgery and the header lines need to be carefully reviewed to determine the actual sender. Thus, a message that appears to be from a person or site that you know probably is not.
CIT is blocking any system, on- or off-campus, identified as sending these messages. The volume of these spam e-mails should be dropping. Unfortunately, these messages are not of a type that is detected by the anti-spam filters on CIT's central mail servers.
Symantec initially called this virus Sober.P, but they have since renamed it to Trojan.Ascetic.C. Full details can be found at:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sober.p@mm.htmlThe definitions for Symantec AntiVirus released earlier today can successfully detect the virus, and the above web link gives instructions for removal. Once again, however, receipt of one of these spam e-mails is not an indication that your system is infected.
Thank you for your attention to this message. We hope it has proven useful.
Cornell Information Technologies
IT Security Office
You can receive messages like this via e-mail by subscribing to the CIT-Alert-L mailing list, which is used to distribute announcements about significant disruptions or threats to the campus computing and telecommunications environment. Visit the CIT-Alert-L subscription page
Last modified: June 04, 2007