Norfolk and Suffolk Rocketry Association

6th October 2003: Virus Email Headers 'From' NASRA

We have become aware of this from error messages being returned to us from virus scanning email gateways that have detected it in messages with a 'Return-To' address of web.feedback@nasra.org.uk. This email address is also included in the list of mail addresses to be attacked by this worm and has, subsequently, been bombarded with infected messages.

This 'attack' both in terms of volume and infection have not affected our systems and, at no point were NASRA vulnerable to this worm or it's associated effects.

This worm is programmed to de-activate on September 10th 2003 and we have received no reports after this date of mail masquerading from any NASRA email addresses.

Although this specific worm is no longer a threat owing to this de-activation, the fact that a NASRA email address has been used to masquerade a Worm message means that it can, and probably will, happen again. Please be aware of this, and of the fact that NASRA will never send un-solicited mail.

Further information on SoBig is available from the McAfee Virus Information Website at:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100561

Communications on this matter should be directed to David Cutting (dcutting@nasra.org.uk)