[Rd] RE: Approved

[(Ted Harding)]

On 02-Jun-03 Peter Dalgaard BSA wrote [to r-devel]:
> "BELL David J" <D.Bell at staffs.ac.uk> writes:
> 
>> No file attached??
> 
> Fairly well-known virus behaviour, but did you really get it from
> r-devel? (check headers for stat.math.ethz.ch)

There seem to be no instances of the actual virus-laden message in
either the r-devel or r-help archives.

This is a new variant (SoBig.C) of the SoBig virus which started
going the rounds a few weeks ago. That one was always "from"
support at microsoft.com, and it picked random "To:" address from
the user's [Windows] system. The new one does much the same, but
this time it also picks a random address to mail "from".

Hence those of you out there who subscribe to r-help or r-devel
and have been infected will from time to time send a virus attachment
as if "from" r-help or r-devel. When this hits a site that spots the
virus and bounces back an error message, the latter will be sent to the
apparent sender and so we will all get it -- without the attachment if
the site has done its job.

This new variant has been out since 31 May, and is not picked up by
virus-screening software capable of detecting the earlier version.
Only signature files updated since 31 May can do this, so you have
to update your virus signature files.

(Or migrate to Linux).

Best wishes to all,
Ted.
[PS the word is that this latest variant will expire on 8 June]