Redesi Worm

From: Heidi (mcps@private)
Date: Wed Oct 24 2001 - 10:27:43 PDT

  • Next message: Zot O'Connor: "RE: new bill being passed in Congress"

    I have been asked a question about the paragraph below from the NIPC report
    dated October 19, third paragraph under Private Sector. It reads only PCs
    running older versions of Windows that use the autoexec.bat file are
    vulnerable.  I have been asked by a person who runs Windows ME about this,
    one would think that Windows ME would not be considered an older version,
    but they did a sysedit and the autoexec.bat file shows up. Would this be
    because ME was installed over an older version of Windows? I did advice that
    they not open any mail they are not familiar with, and to make sure they
    have a good virus program and firewall.   Thank you.  Heidi Henry.
    
    A worm, called Redesi, disguising itself as a security patch for
    Microsoft products, will in fact reformat the victim's C: drive.  The
    worm spreads by e-mail under a number of guises, and is reportedly set
    to trigger on 11 November.  Redesi has so far been seen in two variants;
    either as a Microsoft patch or as what will appear to most people more
    like junk e-mail.  In the first case, the e-mail worm comes with a
    header randomly selected from a list that includes "FW: Microsoft
    security update," and "FW: Security Update by Microsoft."  The second
    variant arrives with headers such as:  "Scientists have found traces of
    the HIV virus in cows milk...here is the proof -- Will", "Yay. I caught
    a fish -- Six", and "I want to live in a wooden house -- Arwel."  Only
    PCs running older versions of Windows that use the autoexec.bat file are
    vulnerable to having their hard disks formatted on 11 November.
    



    This archive was generated by hypermail 2b30 : Sun May 26 2002 - 11:28:42 PDT