Subject: (ngtrans) Ngtrans virus SNAFU

From: "Michael Cole"<[email-masked]>
Date: Sun, 10 Nov 2002 23:44:38 -0800

Dear Ngtrans Folks,

I have apparently been the victim of a rather unusual security vulnerability
that affected what used to be my primary web browsing computer.

The first symptom was that I was getting 'double downloads' of my incoming
email. This would indicate derangement of the Post Office Proxy program in
Norton Antivirus 2001. If anybody else has this symptom, please let me know.

The 2nd symptom was that even though Norton Antivirus said that my system was
clean, I received hundreds of email bouncebacks indicating that I was
spreading W32.brid.a@mm.

I have notified the Computer Emergency Response Team of the apparent
vulnerability in Norton Antivirus. I am not sure if this problem is limited to
Norton Antivirus.

I have had a lot of cross words with Earthlink Support because they cannot be
bothered with installing redundant antivirus software on their email servers.
If all these other ISPs in foreign countries can do it, they can do it too. I
can no longer recommend Earthlink to anybody until they upgrade their servers.

I am very truely sorry for any inconvenience that I may have caused.

If anybody knows of any Internet Service Providers in the U.S. that bothers to
install antivirus software on their email servers, I would like to know.

Sincerely,

Michael R. Cole, [email-masked]

---

From: "Michel Py" <[email-masked]>
Date: Mon, 11 Nov 2002 14:10:15 -0800

Michael,

> Michael Cole wrote:
> even though Norton Antivirus said that my system
> was clean

Are you sure you were the one sending the virus out? For what I have
seen it came from Europe. Lots of us had the same symptoms. 

Michel.