Re: Strange Service is showing up on PC's on our network

From: Knight, Jim (Jim.Knight_at_YUM.COM)
Date: 01/30/04 

Date:         Fri, 30 Jan 2004 15:29:58 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

Thanks to everyone who replied to this query. I would like to point out
that this was discovered yesterday (in part by us), and although your
replies are appreciated, they are no longer necessary.

The message was sent out yesterday morning, and by the time the list got
to posting it, we had already identified this and worked with symantec
to create definitions.

We learned a lot of lessons during this incident (funny how a lvl 4
threat only affects about 40 PC's in our entire International
Environment) but something that barely made it to a lvl 2 caused us so
much work. We had already began writing scripts and implementing GPO's
to stop this so we didn't get it as bad as we could have.

Thanks again,

Jim
  

This communication is confidential and may be legally privileged. If you are not the intended recipient, (i) please do not read or disclose to others, (ii) please notify the sender by reply mail, and (iii) please delete this communication from your system. Failure to follow this process may be unlawful. Thank you for your cooperation.

-----
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
-----