At 02:41 PM 05/04/2000 -0400, you wrote:
>FYI ...
>
>--
>[:)] Dave
>_______________________________________________________
>
>David S. Battey
>Information & Technology Coordinator
>Office of Research and Grants Administration
>College of Charleston, Charleston, SC, 29424
>Voice: (843)953-5673      Fax: (843)953-6577
>Internet:  http://www.orga.cofc.edu/
>E-mail:  xxxxxx@cofc.edu
>_______________________________________________________
>
>Return-path: <xxxxxx@LISTSERV.NTBUGTRAQ.COM>
>Received: from VMS.DC.LSOFT.COM (vms.dc.lsoft.com [209.119.1.27])
>  by cofc.edu (PMDF V5.2-32 #39232) with ESMTP id
> <xxxxxx@cofc.edu>;
>  Thu, 4 May 2000 14:05:20 EDT
>Received: from peach (209.119.0.4)
>  by VMS.DC.LSOFT.COM (LSMTP for OpenVMS v1.1a) with SMTP id
>  <xxxxxx@VMS.DC.LSOFT.COM>; Thu, 04 May 2000 13:40:58 -0400
>Received: from LISTSERV.NTBUGTRAQ.COM by LISTSERV.NTBUGTRAQ.COM
>  (LISTSERV-TCP/IP release 1.8d)
>  with spool id 141114 for xxxxxx@LISTSERV.NTBUGTRAQ.COM; Thu,
>  04 May 2000 13:39:36 -0400
>Received: from 195.193.219.202 by PEACH.EASE.LSOFT.COM (SMTPL release 1.0d)
>  with TCP; Thu, 04 May 2000 11:48:49 -0400
>Received: by aserver1.wall.de with Internet Mail Service (5.5.2650.21)
>  id <K271NP2D>; Thu, 04 May 2000 17:49:03 +0200
>Date: Thu, 04 May 2000 17:49:02 +0200
>From: "Mazeland, Siebrand" <xxxxxx@WALL.NL>
>Subject: 'ILOVEYOU' script worm
>Sender: Windows NTBugtraq Mailing List <xxxxxx@LISTSERV.NTBUGTRAQ.COM>
>Approved-by: xxxxxx@RC.ON.CA
>To: xxxxxx@LISTSERV.NTBUGTRAQ.COM
>Reply-to: "Mazeland, Siebrand" <xxxxxx@WALL.NL>
>Message-id: <xxxxxx@aserver1.wall.de>
>MIME-version: 1.0
>X-Mailer: Internet Mail Service (5.5.2650.21)
>Content-type: text/plain; charset="iso-8859-1"
>X-Mozilla-Status2: 00000000
>
>Recently a script worm has hit many systems. Here is some information on how
>to check for and clean infections on Exchange Server server systems. If off
>topic, please refer to a better suited list.
>
>Cheers!
>
>Siebrand Mazeland
>
>--- BEGIN PASTE ---
>"I Love You" eMail virus.
>Summary
>
>This document is to provide you with steps to purge the ILOVEYOU virus on
>Exchange servers for one time. This virus is spread in various ways.  It
>seems the most prevalent method is via an eMail message, which as the
>following details.
>
>Subject line    "ILOVEYOU"
>Mail text:      "kindly check the attached LOVELETTER coming from me."
>Attachment:     "LOVE-LETTER-FOR-YOU.TXT.vbs"
>Size:   Approx. 13kb.
>
>Steps to cure Exchange 5.5 SP3 and lower
>If you have Exchange 5.5 with SP3 or a lower version, please
>         1.      Download SCAN.ZIP from
>ftp://ftp.microsoft.com/transfer/outgoing/webresponse/
>                         a.
>ftp://ftp.microsoft.com/transfer/outgoing/webresponse/scan.zip.00504.04-07-2
>5
>         2.      Unzip file
>         3.      Copy all files to <Exchange server directory>\bin
>         4.      Run the following command: NET STOP MSEXCHANGEIS
>                         a.      IF you do not want to stop the store, you
>can use the latest version of EXMERGE.EXE. For more information on how to
>use this, please refer to Q-article Q246916 (added as appendix)
>         5.      ISSCAN -pri -fix -test badattach,badmessage -c virus.txt
>         6.      If you have public folders the run the following command too
>                         a.      ISSCAN -pub -fix -test badattach,badmessage
>-c virus.txt
>
>Steps to cure Exchange 5.5 SP3 and Store Fixes
>If you have Exchange 5.5 with SP3 with additional fixes on the store,
>         1.      download SCAN.ZIP and POST-SP3-ISSCAN.EXE from
>ftp://ftp.microsoft.com/transfer/outgoing/webresponse/
>                         a.
>ftp://ftp.microsoft.com/transfer/outgoing/webresponse/scan.zip.00504.04-07-2
>5
>                         b.
>ftp://ftp.microsoft.com/transfer/outgoing/webresponse/post-sp3-isscan.exe.00
>504.06-31-12
>         2.      Unpack SCAN.ZIP
>         3.      Unpack POST-SP3-ISSCAN.EXE, choose to overwrite isscan.exe
>(build 2648) with the new isscan.exe (build 2652.26)
>         4.      Copy all file to: <Exchange server directory>\bin
>         5.      Run the following command: NET STOP MSEXCHANGEIS
>                         a.      If you do not want to stop the store, you
>can use the latest version of EXMERGE.EXE. For more information on how to
>use this, please refer to Q-article Q246916 (added as appendix)
>         6.      ISSCAN -pri -fix -test badattach,badmessage -c virus.txt
>         7.      If you have public folders the run the following command too
>                         a.      ISSCAN -pub -fix -test badattach,badmessage
>-c virus.txt
>
>Please be aware: POST-SP3 ISSCAN is not downwards compatible
>Background information
>
>This is handled in a very similar way to the Melissa virus.
>
> >From an Exchange perspective, the first thing to do is to shut down all IMS
>services, and all MTAs, to stop propagation. It has been suggested that,
>owing to the other infection vectors, HTTP and IRC protocols be stopped as
>well (or as a critical measure, unplug corporate intranets from the internet
>until the crisis is under control).  A company can block these URLs at their
>proxy servers, too.
>
>ISSCAN can then be used to scan all Information Stores for copies of the
>message, and delete them.  This may not get all messages, and especially as
>more may trickle in from the outside, from missed servers, or from PST
>files, this process will need to be repeated over time.  Refer to KB article
>Q224493 (Q224436 talks about handling the Melissa virus and may be of
>assistance, also). Note that the current ISSCAN on the FTP site is only up
>to 5.5.SP3 as per Q260022.  An updated version of this utility has to be
>shipped to requesting customers, as per a hot fix.
>
>Any other preventative / cure measures need to be handled by NT logon
>scripts and/or 3rd party anti-virus programs.
>
>These need to delete the core .vbs files (as described in the analysis
>below), delete the WIN-BUGSFIX.exe files, also the LOVE-LETTER-FOR-YOU.HTM
>file, and remove the registry entries causing these to be run at logon.  The
>WSCRIPT.EXE process should also be killed to stop any current "infection" at
>this time.
>More information on the virus on the web
>www.norman.com
>http://www.f-secure.com/v-descs/love.htm
>--- END PASTE --- Source: wishes to remain unknown

I will be out of the office on Monday, May 8th and Tuesday, May 9th.

If you need assistance, please contact Ms. Janice Haney at (312)  567-3035.

Thank you.

******************************************************
Domenica G. Pappas                              Phone 312-567-3035
Assistant Director                              Fax 312-567-6980
Office of Sponsored Research            xxxxxx@iit.edu
Illinois Institute of Technology
3300 S. Federal Street,  MB Rm 301
Chicago, IL 60616-3793

www.iit.edu/colleges/grad/sresearc.htm
******************************************************

======================================================================
 Instructions on how to use the RESADM-L Mailing List, including
 subscription information and a web-searchable archive, are available
 via our web site at http://www.hrinet.org (click on "Listserv Lists")
======================================================================