swen posts to news

Discussion in 'NZ Computing' started by Peter KERR, Sep 28, 2003.

  1. Peter KERR

    Peter KERR Guest

    It was suggested that the swen worm?virus? got most of its target
    addresses from usenet postings.

    Seems now its going out that route too,
    ironic it should cross-post to mac.* groups:

    -----------------------------------------------
    From: "" <>
    Newsgroups:
    comp.sys.mac.hypercard,comp.sys.mac.oop.macapp3,comp.sys.mac.oop.misc,com
    p.sys.mac.oop.powerplant,comp.sys.mac.oop.tcl,comp.sys.mac.portables,comp
    ..sys.mac.printing,comp.sys.mac.programmer.codewarrior,comp.sys.mac.progra
    mmer.help,comp.sys.mac.programmer.misc
    Subject: Install this critical patch
    Date: Thu, 25 Sep 2003 08:12:21 +0000 (UTC)
    Organization: Ege University InterNetNews site
    Lines: 314
    Message-ID: <bku814$u2t$>
    NNTP-Posting-Host: host81-134-27-142.in-addr.btopenworld.com
    Mime-Version: 1.0
    Content-Type: multipart/mixed; boundary="yfhdylcuvydwsukzn"
    X-Trace: list.ege.edu.tr 1064477541 30813 81.134.27.142 (25 Sep 2003
    08:12:21 GMT)
    X-Complaints-To:
    NNTP-Posting-Date: Thu, 25 Sep 2003 08:12:21 +0000 (UTC)
    Path:
    news.auckland.ac.nz!news.clear.net.nz!news5.aus1.giganews.com!firehose2!n
    ntp4!intern1.nntp.aus1.giganews.com!border1.nntp.aus1.giganews.com!nntp.g
    iganews.com!newsfeed.gamma.ru!Gamma.RU!newsfeeder.edisontel.com!news.pans
    ervice.it!news.ege.edu.tr!not-for-mail
    Xref: news.auckland.ac.nz comp.sys.mac.hypercard:19136
    comp.sys.mac.oop.macapp3:4711 comp.sys.mac.oop.misc:956
    comp.sys.mac.oop.powerplant:23464 comp.sys.mac.oop.tcl:1069
    comp.sys.mac.portables:119734 comp.sys.mac.printing:41076
    comp.sys.mac.programmer.codewarrior:130683
    comp.sys.mac.programmer.help:60423 comp.sys.mac.programmer.misc:27320



    Content-Type: multipart/related; boundary="yaldwvpynplmvkug";
    type="multipart/alternative"



    Content-Type: multipart/alternative; boundary="qbgkxuqthx"



    Content-Type: text/plain
    Content-Transfer-Encoding: quoted-printable

    Microsoft Consumer
    [[snip]]
     
    Peter KERR, Sep 28, 2003
    #1
    1. Advertising

  2. Peter KERR

    Keith Guest

    In article <>,
    in says...
    > It was suggested that the swen worm?virus? got most of its target
    > addresses from usenet postings.
    >
    > Seems now its going out that route too,
    > ironic it should cross-post to mac.* groups:


    Most of the antivirus firms list the groups the worm sends to in their
    analysis of the worm. I've also seen it on other groups so some
    clown/vandal has deliberately sent it to a newsgroup.

    The Trend site has some interesting statistics on the Swen worm:

    *Infection rate*
    Australia and New Zealand 5.1%
    Africa 3.2%
    South America 3.0%
    Europe 2.4%
    North America 2.1%
    Asia 1.0%
    http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SWEN
    ..A&VSect=S

    It would be interesting to know why Austalasia was hit so hard. I don't
    think it would be the pirated software angle because Asia is very low.
     
    Keith, Sep 28, 2003
    #2
    1. Advertising

  3. Peter KERR

    The Flash Guest

    Because Australia and New Zealand are effectivly 24 hours ahead of the
    world, Any virus that strikes hits us first as we are busy beavering away
    at work emailing and such while the rest of the world sits down at sunday
    dinner or is asleep.


    "Keith" <> wrote in message
    news:...
    > In article <>,
    > in says...
    > > It was suggested that the swen worm?virus? got most of its target
    > > addresses from usenet postings.
    > >
    > > Seems now its going out that route too,
    > > ironic it should cross-post to mac.* groups:

    >
    > Most of the antivirus firms list the groups the worm sends to in their
    > analysis of the worm. I've also seen it on other groups so some
    > clown/vandal has deliberately sent it to a newsgroup.
    >
    > The Trend site has some interesting statistics on the Swen worm:
    >
    > *Infection rate*
    > Australia and New Zealand 5.1%
    > Africa 3.2%
    > South America 3.0%
    > Europe 2.4%
    > North America 2.1%
    > Asia 1.0%
    > http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SWEN
    > .A&VSect=S
    >
    > It would be interesting to know why Austalasia was hit so hard. I don't
    > think it would be the pirated software angle because Asia is very low.
     
    The Flash, Sep 28, 2003
    #3
  4. Peter KERR

    T.N.O. Guest

    "Keith" wrote
    > It would be interesting to know why Austalasia was hit so hard. I don't
    > think it would be the pirated software angle because Asia is very low.


    We wake up first...
     
    T.N.O., Sep 29, 2003
    #4
  5. Peter KERR

    Keith Guest

    In article <bl81pm$91b1j$-berlin.de>,
    says...
    > "Keith" wrote
    > > It would be interesting to know why Austalasia was hit so hard. I don't
    > > think it would be the pirated software angle because Asia is very low.

    >
    > We wake up first...
    >


    Nah. It can't just be that. If you go to the Trend site and look at the
    stats from some other viruses the infection rates are totally different.
    If it was just "we're awake first" there would be more consistency.

    BTW Another interesting thing on the site is the daily graph of infection
    reports. There is a peak in the morning, another at lunch time but the
    biggest and widest peak is in the evening when people are tooling around
    (as I am doing now).

    PS Just been back the infection rates for Swen are now:
    Africa 8.7%
    Australia and New Zealand 4.8%
    South America 3.6%
    Europe 2.9%
    North America 2.1%
    Asia 1.5%

    cf with the Klez
    North America 3.3%
    Asia 2.5%
    South America 2.1%
    Australia and New Zealand 1.6%
    Europe 1.5%
    Africa 0.0%
     
    Keith, Sep 30, 2003
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. William W. Plummer

    Combine-and-Decode multipart news posts?

    William W. Plummer, Jul 3, 2004, in forum: Firefox
    Replies:
    0
    Views:
    535
    William W. Plummer
    Jul 3, 2004
  2. Thore Schmechtig
    Replies:
    17
    Views:
    806
    Gregg Dotoli
    Sep 27, 2003
  3. Thore Schmechtig

    [SWEN tiny FAQ] How to filter Swen mails with M$OE 6

    Thore Schmechtig, Sep 25, 2003, in forum: Computer Security
    Replies:
    19
    Views:
    596
    kd7sk
    Sep 27, 2003
  4. joseph

    News Posts Archives and Retention

    joseph, May 27, 2007, in forum: Computer Support
    Replies:
    3
    Views:
    526
    Plato
    May 28, 2007
  5. thingy

    Clear's news server losing posts?

    thingy, Jan 31, 2008, in forum: NZ Computing
    Replies:
    3
    Views:
    285
    thingy
    Feb 3, 2008
Loading...

Share This Page