Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   NZ Computing (http://www.velocityreviews.com/forums/f47-nz-computing.html)
-   -   Re: Re: Re Email Infection (http://www.velocityreviews.com/forums/t567768-re-re-re-email-infection.html)

Nina 09-22-2003 11:40 PM

Re: Re: Re Email Infection
 
Oh yea I most certainly am infected with the worm called swen and there is
another called gibe.
I think you will start to receive your share of hoax messages pretty soon.

Input swen and gibe into Google and you will discover this is a world wide
thing. When I think of all the computer time I have spent on this, and I am
merely a peaceful retiree, business can be crippled.
Nina
>On Mon, 22 Sep 2003 20:03:28 +1200, Nina <knof@xtra.co.nz> wrote:
>>
>>I am also hideously infected as some of those who have written tp PC infected.
>>

>How do you know you are infected? If you are *receiving* these
>"Microsoft" virus emails you are not infected. If you are receiving
>"You have sent us an email with a virus" messages, you are probably
>not infected. If you are receiving "A virus was stripped..." message
>you are probably OK.
>>
>>Now what to do about this worm? I can't find any ref. to it from Norton which
>>returns to me a full bill of health. It lies.
>>

>If Norton says you are safe, you are almost certainly safe.
>
>Here's the Norton writeup:
>
>http://securityresponse.symantec.com...swen.a@mm.html
>
>Cheers,
>
>Cliff
>--
>
>The complete lack of evidence is the surest sign
>that the conspiracy is working.



~misfit~ 09-23-2003 02:30 AM

Re: Re: Re Email Infection
 

"Nina" <knof@xtra.co.nz> wrote in message
news:cr1vmvkfvon076gicrtosg4ckf3ulm39o5@4ax.com...
> Oh yea I most certainly am infected with the worm called swen and there is
> another called gibe.
> I think you will start to receive your share of hoax messages pretty

soon.
>
> Input swen and gibe into Google and you will discover this is a world wide
> thing. When I think of all the computer time I have spent on this, and I

am
> merely a peaceful retiree, business can be crippled.


You still don't get it do you Nina? Just because you are getting these
messages doen't mean you are infected. It just means that someone with your
address in their address book could be or, looking up at the headers, you
post using what looks to be a real return addy, un-munged. The worm may have
harvested your addy from usenet and used it as a 'return' addy when sending
it's payload. It has been postulated that the worm also trawls through
usenet postings on infected computers, posting to both addys and newsgroups
and spoofing the return addys from the posts it finds.

Therefore, if I had the worm, you could be getting these emails etc. because
I'm infected as I now have your email address in my newsreaders logs. It's a
step up from malware just checking address books and has the potential to be
a lot more virulent because of this.

(There goes my long-held theory that it's OK to use OE for usenet, just not
for email)

Munge your return addy in your newsreader, although it's a bit late in this
case it will stop it happening again. (Although, another postulation I've
head is that the worm is trawling google archives for addys. Some people are
reporting these emails on addys they used to use in the past as return addys
when posting but have since long ceased to use. Less likely I think, more
likely that someone somewhere still had one of their older posts on an
infected computer.)

Of course it's a world wide thing, so is this internet thing. 'Mazing ay?
--
~misfit~



---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.520 / Virus Database: 318 - Release Date: 18/09/2003



Enkidu 09-23-2003 07:09 AM

Re: Re Email Infection
 
Nina,

If you have NAV you almost certainly DON'T have those viruses! Even if
you weren't quite up to date with the virus defs, NAV detects them
automatically as Worm.Automat.AHB.

What makes you think that you are infected? If others are receiving
viruses supposedly from you, it's extremely likely that the emails are
faked *on someone else's machine*. Please tell us why you think that
you are infected.

Cheers,

Cliff

On Tue, 23 Sep 2003 11:40:57 +1200, Nina <knof@xtra.co.nz> wrote:

>Oh yea I most certainly am infected with the worm called swen and there is
>another called gibe.
> I think you will start to receive your share of hoax messages pretty soon.
>
>Input swen and gibe into Google and you will discover this is a world wide
>thing. When I think of all the computer time I have spent on this, and I am
>merely a peaceful retiree, business can be crippled.
>Nina
>>On Mon, 22 Sep 2003 20:03:28 +1200, Nina <knof@xtra.co.nz> wrote:
>>>
>>>I am also hideously infected as some of those who have written tp PC infected.
>>>

>>How do you know you are infected? If you are *receiving* these
>>"Microsoft" virus emails you are not infected. If you are receiving
>>"You have sent us an email with a virus" messages, you are probably
>>not infected. If you are receiving "A virus was stripped..." message
>>you are probably OK.
>>>
>>>Now what to do about this worm? I can't find any ref. to it from Norton which
>>>returns to me a full bill of health. It lies.
>>>

>>If Norton says you are safe, you are almost certainly safe.
>>
>>Here's the Norton writeup:
>>
>>http://securityresponse.symantec.com...swen.a@mm.html
>>
>>Cheers,
>>
>>Cliff
>>--
>>
>>The complete lack of evidence is the surest sign
>>that the conspiracy is working.


--

The complete lack of evidence is the surest sign
that the conspiracy is working.


All times are GMT. The time now is 04:27 PM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.