How do you know you didn't get infected by Swen?

Swen may have done us a favor. His virus is so annoying it may deter
other hackers from writing viruses. Can't someone write an anti swen
virus that infects every computer in the world by removing swen from
their computer? Swen I know you are reading this because you probably
want all the attention you can get and you are probably inudated by
your own virus generated emails. How about turning this off.

Thanks
Jim

Swen may you have an interesting life.





On 17 Nov 2003 04:44:08 -0800, (wylbur37)
wrote:

>How can you really determine whether or not your computer has been
>infected by the Swen worm?
>
>Having an anti-virus program report "no infections" is not necessarily
>conclusive since it's possible that the anti-virus program wasn't
>updated, or the update didn't include the code for Swen.
>
>Is there a program available that was written specifically to detect
>Swen?
>
>Alternatively, are there specific symptoms to look for (such as the
>existence of certain files or executables) that would reveal the
>presence of Swen?
>
>How can you be sure you didn't get infected by Swen?

Jim Warren

On Mon, 17 Nov 2003 04:44:08 -0800, wylbur37 wrote:

I'm running Gentoo linux, and thus immune to Swen, but that hasn't
prevented me from getting pounded with attempts. A few months ago I
suddenly started getting large numbers of them. At first, they were what I
will call 'direct attacks' - i.e. an email sent to me masquerading as a MS
update or something else I should run. But increasingly, they became
notifications from ISP's that 'my' (virus laden) mail was undeliverable,
from which I conclude that either my email address is the return address
on attacks to other people - many of whom are bad addresses, or that this
is actually a more subtle form of attack which attempts to get me to
figure out what I was trying to send to someone by running it. Its hard to
tell, as the so-called intended recipient is often a gibberish address.

Its trivial to use procmail to filter these things (based on
mime-content), so I've been keeping them for statistical purposes. Here is
a graph of the inbound rate so far:

http://home.comcast.net/~jcunningham...virusgraph.gif

-Jeff Cunningham

Jeff

On that special day, Jim Warren, () said...

> Swen may you have an interesting life.

Only that his name is Begbie (Slovakia). He dropped the name somewhere
in the worm body.


Gabriele Neukam




--
Ah, Information. A good, too valuable theses days, to give it away, just
so, at no cost.

Gabriele Neukam

On 2003-11-22, Gabriele Neukam <> said:
> On that special day, Jim Warren, () said...
>
>> Swen may you have an interesting life.
>
> Only that his name is Begbie (Slovakia). He dropped the name somewhere
> in the worm body.

Interesting. If there was any justice in the world, it wouldn't matter
what his birth name was. He would just be Bubba's new bitch. With a
whole load of nasty things dropped into *his* body.

Regards,

Pete.

--
http://homepage.ntlworld.com/alternative.carpark

Transmute

"Jim Warren" <> wrote in message
news...
> Swen may have done us a favor. His virus is so annoying it may deter
> other hackers from writing viruses. Can't someone write an anti swen
> virus that infects every computer in the world by removing swen from
> their computer? Swen I know you are reading this because you probably
> want all the attention you can get and you are probably inudated by
> your own virus generated emails. How about turning this off.
>
> Thanks
> Jim
>
> Swen may you have an interesting life.
>



I feel so unloved, I havent got single swen. Infact the only virus Ive had
the past 6years is the blaster worm i picked up off a mpg on kazaa

--
Mimic

"Without Knowledge you have fear, With fear you create your own nightmares."
"There are 10 types of people in this world. Those that understand Binary,
and those that dont."
"C makes it easy to shoot yourself in the foot. C++ makes it harder, but
when you do, it blows away your whole leg"

Mimic

On Sun, 23 Nov 2003 00:53:22 -0000, "Mimic" <> wrote:

>I feel so unloved, I havent got single swen. Infact the only virus Ive had
>the past 6years is the blaster worm i picked up off a mpg on kazaa

All of yours are being sent to yeonho,Lee. At least that's the
name of the registrant for the domain void.net.

Regards, Dave Hodgins
--
Change nospam.invalid to rogers.com to reply by email.

David W. Hodgins

"David W. Hodgins" <> wrote in message
news:...
> On Sun, 23 Nov 2003 00:53:22 -0000, "Mimic" <> wrote:
>
> >I feel so unloved, I havent got single swen. Infact the only virus Ive
had
> >the past 6years is the blaster worm i picked up off a mpg on kazaa
>
> All of yours are being sent to yeonho,Lee. At least that's the
> name of the registrant for the domain void.net.
>
> Regards, Dave Hodgins
> --
> Change nospam.invalid to rogers.com to reply by email.

LOL

--
Mimic

"Without Knowledge you have fear, With fear you create your own nightmares."
"There are 10 types of people in this world. Those that understand Binary,
and those that dont."
"C makes it easy to shoot yourself in the foot. C++ makes it harder, but
when you do, it blows away your whole leg"

Mimic

Mimic wrote:
> "David W. Hodgins" <> wrote in message
> news:...
>
>>On Sun, 23 Nov 2003 00:53:22 -0000, "Mimic" <> wrote:
>>
>>
>>>I feel so unloved, I havent got single swen. Infact the only virus Ive
>
> had
>
>>>the past 6years is the blaster worm i picked up off a mpg on kazaa
>>
>>All of yours are being sent to yeonho,Lee. At least that's the
>>name of the registrant for the domain void.net.
>>
>>Regards, Dave Hodgins
>>--
>>Change nospam.invalid to rogers.com to reply by email.
>
>
> LOL

You may LOL but Dave was being serious. Using a domain that is registered to
someone else means exactly what he said. That address may/will be harvested from
Usenet posts and the owner of the void.net domain may/will get any nasty stuff
that you would have got had your address been there. Lets just hope he has the
facility to reject mail sent to "null". I get loads of crap that gets rejected
by my mail server that is sent to user "newsgroups".

Maybe you could mask your real address in another more net friendly way....?

--
Richard Howlett

Mail to "newsgroups" will be rejected.
Mail to my forename will not.

Richard Howlett

On Mon, 24 Nov 2003 02:09:17 +0000, Richard Howlett
<> wrote:

>Maybe you could mask your real address in another more net friendly way


That or use microsoft.com

Bill

I have had the same problem as you have and it started from this
newsgroup but whomever sent it to me...you where not successful in
tricking me into thinking that that was a security patch.Anyway...Just
change your password for whatever server you use and create filters to
catch the virus before it reaches you.Hope that helps you.


On 17 Nov 2003 04:44:08 -0800, (wylbur37)
wrote:

>How can you really determine whether or not your computer has been
>infected by the Swen worm?
>
>Having an anti-virus program report "no infections" is not necessarily
>conclusive since it's possible that the anti-virus program wasn't
>updated, or the update didn't include the code for Swen.
>
>Is there a program available that was written specifically to detect
>Swen?
>
>Alternatively, are there specific symptoms to look for (such as the
>existence of certain files or executables) that would reveal the
>presence of Swen?
>
>How can you be sure you didn't get infected by Swen?

Cyberphreak101