Security Incidents: Re: Has anyone else seen/encountered the "VBS.Network" virus? Ijust did.

[sheppard () MITRE ORG (Sheppard,Martin L.)]

Hello all,

The email that was originally written with subject "Lame Windows Worm"
(LMW)  apparently contains a pattern that Norton Antivirus (NAV)
believes is the actual virus he describes.  It had me working a bit to
figure out what file had the "virus"  as it would not allow my email
client (Netscape) to copy the suspect message to the local harddisk.  I
had to deactivate my NAV and download my email.  I then re-activated NAV
and scanned my disk.  NAV pointed to the file holding all the mail from
the INCIDENTS list.  I then tried to move each of the new emails from
the INCIDENTS list one by one to a test folder.  When I attempted to
move the LMW message, NAV denied access to the email folder.  I kept
moving files till the only message in the folder was the LMW message.  I
deactivated NAV so I could access the message and copied the text from
the message to a text file.  I reactivated NAV and re-scanned my drive.
NAV then reported two virus' on my drive, one the file holding the
single email message LMW, the other a text file containing only the text
from the LMW message. Hope this helps someone, avoid wasting as much
time as I did figuring out which message was driving NAV crazy.

later,
marty.