PDA

View Full Version : Email Virus Watch!!!


WebGuy
08-21-03, 07:59 AM
Lots of people were hit in the past couple weeks with a new email worm. You might have it and nto even know it. It was followed a variant o the virus which allegeded to be a fix from Microsoft. This week we have a whole new virus.

Keep your systems up to date. Run windows update every month. Update your virus scanner when ever youare alerted to. If your scanner never alerts you that it's out of date, check you scanner settings and tell it to. Make sure your scanner is checking both incoming and outgoing emails. If you use internet explorer, turn off the preview pane. Good news for AOLers. AOL scans the email before you get it so even though it's not fool proof at least they are loking out for you.

I've already had to clean two systems and I have two more sitting in my living room waiting for me. I'm also still busy updating all the other machines so we don't have more issues. These are nasty little virii and they aren't easy to clean off your system. The best solution is to keep them out.


Many of the club memers are infted. Every time one fo these email virus' comes through, the club email gets hit. It's hit by infected members. We've been geting alot of infected mail these past 2 weeks so check your systems. I normally delete the email immediatly, but for the next couple weeks, if I get an infected email from a member I'll very carefully reply to it and let you know what you've got.

NEW YORK (Aug. 20) - A virus that debuted this week has been declared the fastest spreading e-mail plague of all time, while another malicious program that hit last week continued to disrupt computers worldwide.

MessageLabs Inc., a company that filters e-mail for corporate clients around the world, Wednesday said it had intercepted more than a million copies of the ``Sobig.F'' virus the previous day, the most it has ever intercepted in a single day. That was one in every 17 e-mail messages the firm scanned.

``That's just a number we've never seen before,'' said Brian Czarny, MessageLabs' marketing director. The most widespread virus of all time, ``Klez,'' at its peak accounted for one in 125 messages scanned.

Sobig.F continued to spread aggressively on Wednesday, though the pace eased off a bit to about one in 60 messages, he said.

The virus, which is the sixth and latest strain of a virus that first emerged in January, spreads through Windows PCs via e-mail and corporate networks. Besides clogging e-mail systems with messages carrying subject lines like ``Re: Details'' and ``Re: Wicked screensaver,'' the virus also deposits a Trojan horse, or hacker back door, that can be used to turn victims' PCs into relayers of spam e-mail.

``It's a seeding,'' Czarny said. ``All they're looking to do is plant that Trojan.''

Another virus, of the self-spreading kind called a ``worm,'' first appeared last week and was still causing problems Wednesday. The worm, dubbed ``Blaster,'' spreads through Internet connections to PCs using versions of Microsoft Corp.'s Windows operating system that haven't been fixed for a programming flaw. Microsoft disclosed the error, and provided a patch, on July 16.

Blaster was followed this week by the derivative ``Nachi'' or ``Welchia,'' which attempts to inoculate computers by downloading the patch from Microsoft. However, the new worm is causing more problems than Blaster, and brought down Air Canada's ticketing systems Tuesday.

Railway giant CSX Corp. said a ``worm virus'' brought down its signaling systems early Wednesday morning, causing delays and canceled trains through the Eastern states.

Andy Ellis, chief security architect at Web services company Akamai Technologies Inc. said ``Nachi'' may not be more widespread than Blaster, but it is technically superior and is now generating twice as much Internet traffic as Blaster.

A lot of companies have been reporting problems inside their networks, he said, and there have been ``a couple of points where parts of the backbone had performance issues'' in the last 24 hours.

``Nachi is a long-term problem that has to be dealt with. These systems absolutely have to be patched,'' Ellis said.

08/20/03 20:40 EDT

Copyright 2003 The Associated Press. The information contained in the AP news report may not be published, broadcast, rewritten or otherwise distributed without the prior written authority of The Associated Press. All active hyperlinks have been inserted by AOL.

STEVEN LONG
08-21-03, 12:05 PM
Tried to respond to the poll ... got the followiing error:

<<The action you have attempted could not be performed as your session appears to be invalid. Click the below link to attempt this action again with a new session.>>

---What's the scoop? I thought this error was addressed quite some time ago? Is ANYONE doing anything about these WEB problems?

Dennis Trayes
08-21-03, 12:40 PM
Just voted. No errors here.

STEVEN LONG
08-21-03, 12:52 PM
Yes Dennis ... as was the case before ... the polls work for some ... but not all. We've been told that the situation will be looked into.

WebGuy
08-21-03, 02:15 PM
Originally posted by STEVEN LONG
Tried to respond to the poll ... got the followiing error:

<<The action you have attempted could not be performed as your session appears to be invalid. Click the below link to attempt this action again with a new session.>>

---What's the scoop? I thought this error was addressed quite some time ago? Is ANYONE doing anything about these WEB problems?


what is the full web address you see when looking at this page?
how are you connected to the net?
what operating system are you using?
what web browser and what version?



--------------------


looks like I won't be able to email the infected. this virus doesn't send it self to your friends pretending to be you. It finds an email address sored on your computer and pretends to be that person. That means if you get infected, it checks your addres book and finds the address of one of your friends. It then spreads itself using your friends email instead of yours.



What Are These Messages I Am Getting From*MAILER-DAEMON@aol.com?
*
Whenever you receive a message from a "mailer-daemon," it means that your Internet service provider did not accept your e-mail for some reason. Usually, it is because you have misspelled the recipient's e-mail address.
*
You might also receive messages from "mailer-daemon" today and over the next few days because someone you know is infected with the "Sobig" worm. The worm infects other computers by sending a copy of itself to all the e-mail addresses it finds on the infected computer. The worm randomly selects one of the e-mail addresses it finds and uses it to forge the sender's address. If the worm on your friend's computer picked your e-mail address as the sender, then you are receiving the "mailer-daemon" messages from the recipient's Internet service provider informing you that the e-mail that you supposedly sent was rejected.
*
If the recipient was an AOL member, the e-mail would be rejected because our mail system checks all incoming attachments for viruses and refuses to deliver or*send the e-mail until the infected file attachment has been removed or cleaned up. These virus scans are done automatically for your protection. This service is included with your membership to AOL.
*
If I Am Getting These MAILER-DAEMON Messages, Am I Infected With the Sobig Worm?
*
Not necessarily. All it means is that your e-mail address was stored somewhere on an infected computer. You must update the virus definition file for your anti-virus software and then*run an anti-virus scan of your computer to determine if you are infected with the worm.
*
What Is the Sobig worm?

The "Sobig" worm, also known as*W32.Sobig.f@mm,*is a*malicious program circulating on the Internet. If your computer becomes infected with the worm,*an unauthorized person*can remotely download and run programs on your computer, stealing confidential information from you, or use your computer to send spam.

Am I Vulnerable?

Yes, if you use Windows. The worm can*infect Windows 95, 98, ME, NT, 2000, and XP.*Macintosh*operating systems are unaffected by this worm.*

How Can I Help Protect Myself?

1. Be careful. Don't download any*e-mail attachments, even from people you know,*with any of the following subject lines:
*
*** -*** Re: Details
*** -*** Re: Approved
*** -*** Re: Re: My details!
*** -*** Re: Thank you!
*** -*** Re: That movie
*** -*** Re: Wicked screensaver
*** -*** Re:*Your application
*** -*** Thank you
*** -*** Your details
*
*** The e-mail attachment*might have one of the following names:
*
*** -*** your_document.pif
*** -*** document_all.pif
*** -*** thank_you.pif
*** -*** your_details.pif
*** -*** document_9446.pif
*** -*** application.pif
*** -*** wicked_scr.scr
*** -*** movie0045.pif
*

WebGuy
08-21-03, 02:18 PM
NEW YORK (Aug. 21) - A computer virus that circulated across the Internet this week, hard on the heels of another nasty online infection, has been declared the fastest e-mail outbreak ever.

MessageLabs Inc., which scans e-mail for viruses, said that within 24 hours it had scanned more than 1 million copies of the ''F'' variant of the ''Sobig'' virus, which was blamed for computer disruptions at businesses, colleges and other institutions worldwide.

The previous record was ''Klez,'' with about 250,000 copies spotted during its first 24 hours earlier this year, MessageLabs chief technology officer Mark Sunner said Thursday.

There have been faster outbreaks on the Internet, but those circulated through networking functions built into Windows operating systems.

The ''Slammer'' worm struck more than 75,000 computers in just 10 minutes in January, the number of infected computers doubling every 8.5 seconds, according to researchers at the University of California and other institutions. It went on to infect hundreds of thousands more.

E-mail viruses like ''Sobig'' can hit the same computer multiple times, so the number of infections are not directly comparable.

Sunner said the latest virus was able to spread so quickly because it essentially had e-mail software built-in. Previous ones relied on existing software packages like Microsoft's Outlook and did not spread as quickly among users of rival e-mail software.

Sobig began appearing Tuesday, just a week after a separate virus, ''Blaster,'' wreaked havoc on computer systems across the world.

Sobig does not physically damage computers, files or critical data, but it tied up computer and networking resources, forcing networks like the University of Wisconsin-Madison to shut down outside access to its e-mail system Wednesday.

''We were removing 30,000 bad e-mails an hour,'' said Jeff Savoy, an information security officer at the school.

In India's high-tech city of Bangalore, dozens of cybercafes shut down and home computers blacked out. Some cafes were hit because their service provider was affected, but others got the virus in their machines using Windows operating systems.

''Our cybercafe has been down since Tuesday night,'' said Afar, a cafe manager in north Bangalore who goes by a single name. ''Customers are returning home disappointed.''

The owner of one of the Internet's most popular e-mail lists, technologist David Farer, was livid about Sobig.

''I got 1300 junk e-mails 'delivered' this AM,'' he said in a message to subscribers Thursday. ''Find the person and put him/her in jail.''

AP-NY-08-21-03 1206EDT

STEVEN LONG
08-21-03, 02:26 PM
---After I clicked to vote ... the URL switched to

http://www.ccdv.com/forum/poll.php?action=pollvote&pollid=19&optionnumber=1

... whereby the previously noted error message was displayed.

I am using AOL 8.0 (other computer is AOL 7.0)
I am using Windows XP (other computers are Windows 98 & ME.
All computers utilize a 56K dial-up modem.

JC,03,Z06
08-21-03, 02:27 PM
Hi Steve:

You known what ? I bet those darn RICER'S found out you don't like them. Now there messing with you .


:D :) John :) :D

STEVEN LONG
08-21-03, 02:33 PM
:p

It's not that I don't like them ... there's just nothing to like!

I was watching TV last night ... BACHELOR PARTY (early Tom Hanks). Some GQ stud purchased a new Porsche (911 variant, I think). Someone took the car, and made it look like it was "at home in Tijuana". Oy!

Also saw a Saturn SL2 (sedan) today. HUGE rear wing on the car ... probably as big as is on a C5R ... car was complete with a bee-hive attached to the exhaust system. Does this qualify as a RICER?

Dr. Dan
08-22-03, 06:07 AM
Web Guy,
I've had 3 of those MAILER-DAEMON messages a few days ago and opened one of them. Does that mean that I'm infected? I've updated my Norton AV and run it without anything showing up. How concerned should I be?

Bill Burkholder
08-23-03, 10:49 AM
Someone with CCDV@ccdv.com in their address book is infected!!!!!! in two days I have had 187 infected e-mails that Norton has picked up!!!!! W32.Sobig F is the virus......

YO-EL
08-25-03, 08:12 AM
Teddy bear icon is a virus... Delete it

C5pilot
08-25-03, 08:43 AM
Originally posted by indypace78
Teddy bear icon is a virus... Delete it

I hope you're not referring to the email that tells you to delete the Windows file with the teddy bear icon... It's a hoax! ;cc

How come when I ask people to do something to help themselves they ignore me, but they jump when the get strange emails? ;ce

STEVEN LONG
08-25-03, 09:31 AM
Teddy bear icon is a virus... Delete it ---- HOAX
---I agree! The teddy bear file is an appropriate file. The HOAX has been around for quite some time. You can confirm the validity of many, many hoaxes ... just go to www.McAfee.com

STEVEN LONG
09-11-03, 08:35 PM
Quote from WebGuy:
what is the full web address you see when looking at this page?
how are you connected to the net?
what operating system are you using?
what web browser and what version?

WebGuy ... What's the status with this?