Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!wuarchive!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: andrew.mckendrick@f854.n681.fido.oz.au (Andrew McKendrick)
Newsgroups: comp.virus
Subject: Hepnet or Wank worm (VAX VMS)
Message-ID: <0001.a9102112100.AA03693@ubu.cert.sei.cmu.edu>
Date: 23 Jan 91 02:21:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 16
Approved: krvw@sei.cmu.edu

Having not had access to a DEC mainframe and ACSnet for a year or so,
I've lost track of what was happening with the Hepnet/Wank worm that had
been reported to be screaming around mainframe nets.
Can anyone update me on what has happened to that worm??

Andrew Mckendrick

[Ed. Two versions of WANK were seen on SPAN and other DECNET networks
in October 1989.  Both versions seemed to run their course within a
couple of days.  CERT put out an advisory (filename
CA-89:04.decnet.wank.worm) on October 17, 1989 - available by
anonymous FTP on cert.sei.cmu.edu in pub/cert_advisories.  The
advisory provides an analysis of the WANK worms.]

- --- LED ST 0.10
 * Origin: 520StE... Is Modula-2 wirth it?. (3:681/854.3)