As mentioned by my follow-up note to RESADM-L, the
ZIP-attachment-with-a-password method is a new way of virus propogation
which defeats enterprise-level mail server virus scanners (which cannot
scan within the ZIP file as they normally would due to the password).  I am
working to block these attachments.

Remember Email rule #1:  NEVER open a attachment unless you were expecting
it.  EVEN if you know the sender!

-- Mike Varney / HRI

 "Herbert B.
 Chermside"               To:       "Mike L. Varney" <xxxxxx@health.state.ny.us>,
 <xxxxxx@vcu.edu>          xxxxxx@UMRESEARCH.UMD.EDU
 cc:
 05/10/2004 09:39         Subject:  Re: [RESADM-L] New changes
 AM

The following message was purported to be sent through xxxxxx@HRINET.ORG
xxxxxx@UMRESEARCH.UMD.EDU.  It contained a password (noted below by "x")
which was deleted by some protection software in the transmission
process.  It had two attachments, a .JPG file and a .TXT file, the latter
of which was deleted by the same protection program; neither is contained
in this query.

Was this an intended message, or is it spam or some other malicious
message?  If intended, is there some other way the information can be
transmitted?  If malicious, is there any other protection that can be used
by the listserve to prevent a repetition?

Contact me at xxxxxx@vcu.edu if more information is needed.

Chuck

At 09:52 AM 5/10/2004, you wrote:

>Attached file is protected with the password for security reasons.
>Password is
>[]
>
>
>======================================================================
>Instructions on how to use the RESADM-L Mailing List, including
>subscription information and a web-searchable archive, are available via
>our web site at http://www.hrinet.org (click on "Listserv Lists")
>======================================================================

Herbert B. Chermside, CRA
Special Asst. to VP-Research
Virginia Commonwealth University
PO BOX 980568
Richmond, VA  23298-0568
Voice:  804-827-6036
Fax     804-828-2051
e-mail xxxxxx@vcu.edu

======================================================================
 Instructions on how to use the RESADM-L Mailing List, including
 subscription information and a web-searchable archive, are available
 via our web site at http://www.hrinet.org (click on "Listserv Lists")
======================================================================