Subj : Long ago and far away...
To   : Mark Lewis
From : Mike Luther
Date : Fri Apr 12 2002 02:51 pm

Hey Mark!

Long ago and far away when you mailed me that description of the CERN release 
of the NimdaA virus text ... chuckle ..

    gess what?

Well .. I haven't scanned all the Fido messages for a good while with NORMAN as 
I try to catch the stuff in I/O with it instead ... well.

I chucked in the latest OS2_UPD.ZIP today as usual from Norman.  For evil sake 
I let it scan the whole HUB box just for whatever ..  POOF!   It yanked your 
FidoNet Echomail message and smirffed A76.MSG off into the infected directory 
as flagged with NimdaA of all things!  Took a look at it with an editor and 
lo..  What it did was found the infector text description for the java script 
mechanism and snagged it!  That despite the plainly stated text in the CERN 
alert doc which said it had been suitably modified so as to not be the exact 
text of same!

Clever!

I had no idea that the description of these things in a plain text file would 
trigger the matrix match .. but, of all things .. this one did!

Just for fun I post to you the tale.


--> Sleep well; OS/2's still awake! ;)

Mike @ 1:117/3001

--- Maximus/2 3.01
 * Origin: Ziplog Public Port (1:117/3001)

.