Virus Detected

Greetings All,
Just received an E mail from "philskene" at hotmail.com. My system detected a virus, but was unable to remove it. It appears as a W32 type virus. After thinking about it, I remembered there is an TS member named philskene. Anybody out there having a similar problem? It may be nothing but this is just a heads up. KRO52

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

RE: Virus Detected, derekmorton, Jun-13-04, 03:59 AM, (1) RE: Virus Detected, Jonatan, Jun-13-04, 06:18 AM, (2) RE: Virus Detected, derekmorton, Jun-13-04, 07:18 AM, (3) RE: Virus Detected, Jonatan, Jun-13-04, 07:56 AM, (4) RE: Virus Detected, derekmorton, Jun-13-04, 08:05 AM, (5) RE: Virus Detected, tcain1, Jun-13-04, 09:50 AM, (8) RE: Virus Detected, rpicardi1, Jun-13-04, 05:04 PM, (13) RE: Virus Detected, tcain1, Jun-13-04, 06:17 PM, (17) RE: Virus Detected, derekmorton, Jun-13-04, 05:58 PM, (15) RE: Virus Detected, rpicardi1, Jun-13-04, 09:01 AM, (6) RE: Virus Detected, tcain1, Jun-13-04, 09:23 AM, (7) RE: Virus Detected, heffed, Jun-13-04, 11:20 AM, (9) RE: Virus Detected, sinclair97, Jun-13-04, 12:16 PM, (10) RE: Virus Detected, Jonatan, Jun-13-04, 03:04 PM, (11) RE: Virus Detected, rpicardi1, Jun-13-04, 05:31 PM, (14) RE: Virus Detected, derekmorton, Jun-13-04, 06:04 PM, (16) RE: Virus Detected, heffed, Jun-13-04, 06:48 PM, (18) RE: Virus Detected, baldwin, Jun-13-04, 03:06 PM, (12) RE: Virus Detected, sinclair97, Jun-13-04, 06:50 PM, (19) RE: Virus Detected, heffed, Jun-13-04, 08:44 PM, (20)

Conferences | Topics | Previous Topic | Next Topic

It is more likely that someone else with both your email address and philskene's email address has a virus.
If you can post the 'header' of the email I can tel you exactly where it came from.

Derek
EngMod@sgrail.org
www.sgrail.org

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Jun-13-04 AT 06:20 AM (EDT)

I got a mail with some wierd name like "yuoosndgk" that contained a virus so Norton yelled at it so it went away. EDIT: First time something slipped through my Router. O_O/JonatanSteam rules!

Never trust computers. If you do, they will betray you.I'm the steam freak, ph34r me!!

My E-mail jonatan.gronoset@telia.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Jonatan,Routers don't stop email.

Derek
EngMod@sgrail.org
www.sgrail.org

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Ours do as it got a firewall in it./JonatanSteam rules!

Never trust computers. If you do, they will betray you.I'm the steam freak, ph34r me!!

My E-mail jonatan.gronoset@telia.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Firewalls don't stop emails.
Ports 25 and 110 have to be open for email.

Derek
EngMod@sgrail.org
www.sgrail.org

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

>Firewalls don't stop emails.
>Ports 25 and 110 have to be open for email. Actually they can. They can block incoming attachments which have extentions identified as those used to carry malicious code like .EXE or .PIF. Zone Alarm Pro incorporates this feature!!

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

You also want a good popup and popunder blocker. Some of them have been malicious as of late.Example, a popup that came in from a popular weather web site, wanted to install a clock sync program. Instead of killing it at the task bar, I had closed it at the close button. Unknowingly, the close button had been programmed to execute some Active-X code which did the following;
1. It closed the popup.
2. It reset the default web page to a malicious web site called defaultpage . com. (Don't blame me if you are stupid enough to go to that web site out of curiosity and screw up your computer.)
3. It installed commands into the registry for configuring this web page on startup. (I found this out much later when doing a registry cleanup operation.)The next time that I went on line, instead of the Charter home page loading, the hijacked site loaded instead followed by several popups for various garbage and porno sites. At the same time, the firewall went nuts blocking additional stuff trying to enter other ports. The web page and popups could not be killed off except by using the task manager. It took several minutes to restore all of the hijacked settings back to normal.A company in Hawaii wasn't so lucky. In addition to the hijacked browser, they got several additional web pages that opened up to porno sites that wouldn't close, and a bunch of viruses and spyware installed into their business computer.No doubt, subscribers to Weather Underground were extremly upset later that day.There are several ways that the malicous software is being installed on unsuspecting computers.
1. e-mail attachments. The programs are installed when the attachment is opened.
2. Html commands in e-mail. This can send a command to download and install some malicious program. The mail has to be opened to activate this.
3. Random probe of IP addresses to look for open ports. When one is found, some malicious program can be installed. Just being connected to the Internet is all that is needed for this to happen.
4. Downloading some cute free software and many underground file sharing software will open the doorway for installation of malicious software.
5. Malicious active X scripts from popup ads and hijacked web sites.The malicious software may do any or all of the following;
1. Look for the user's address book, spoof the sender's address, and send copies of itself to everyone on that list. It may avoid sending mail to a list of names such as antivirus site addresses.
2. Disable antivirus and firewall software. It will either terminate the process, or cripple the software in such a way that it appears to be still functioning.
3. Make changes to the registry as it is installed and hide copies of itself in your computer and network.
4. Open ports to a remote computer, report the IP address of the computer it is on, and wait for further instructions from the remote system. This could be a command for installing additional software, or launching an attack at a pre determined time on the Internet. It could also set up the infected computer to be used as a remote server for stuff such as child pornography or worse.
5. Monitor the use of your keyboard while you are on the internet and log all passwords, bank accounts, and credit card numbers when certain sites are visited. it then sends the information to a remote computer and eventually back to the author.
6. Blocks access to Microsoft and selected other web sites.
7. Keep a log of all activity on your computer and report back this information to a remote server.
8. Destroy all data on your computer hard drive at a pre determined time.Given the current war on terrorism and the popularity of the internet, there is a lot of damage that can be done both to business computers and home users. It's no surprise that the past few months have been busy ones as the attacks get bolder and more complex.Anyone that is not practicing safe internet surfing, they don't keep antivirus current, they are not blocking popups, they allow Active X scripts to run from any site, they don't use a firewall, they are careless with e-mail, they allow spyware to run their computer, and they leave their computer on 24-7 with an active broadband internet connection, They will be responsable for any terrorist attack of the internet that is certain to be launched in the near future. It is those, so far estimated half a million infected computers, where this attack will be launched from.SRV Ron

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

One other more dangerous thing these viruses/worms can do is search out personal information that may be sitting in a file on your computer maybe without you knowing it. Things like credit card numbers, or worse Social Security Numbers. These may be found in your Internet cache if you purchase items on the web. They may or may not be encrypted, but even if they are, encryption is not perfect and may be broken. Some financial sites require you to use your SS numbers so those become vulnerable also. If someone gets your SS number, they can do allot of damage to you personally. Things like open Credit Card accounts in your name, get loans in your name etc... It's called identity theft. You should protect yourself by clearing out your cache regularly. You can use the Windows disk cleanup tool for this, but more efficient tools are available as this threat if becoming more and more dangerous. Firewalls like ZoneAlarm Pro now include this feature, and can be automated. They also have a new feature which will lockup so to speak some personal identification numbers so you would get an alert if that combination of data was to attempt to cross into the net. I'm a little leery of this though, as you have to tell the firewall these numbers, so there would be a file on your computer with this info. If a virus at some point was to hack into the firewall, it may potentially be able to exploit this information. So as of yet I haven't used it.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

>>Firewalls don't stop emails.
>>Ports 25 and 110 have to be open for email.
>
>Actually they can. They can block incoming attachments which have extentions identified as those used to carry malicious
>code like .EXE or .PIF. Zone Alarm Pro incorporates this feature!! The point I am trying to make is that a 'firewall' does not block email.
There is something extra that blocks dangerous email extensions.

Derek
EngMod@sgrail.org
www.sgrail.org

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I got one bounced back that I didn't send last week. Funny, I didn't know that I type my mail in German. Those that know should have no problem tracing the source for this one.This week has been very quiet compared to the attacks being launched trying to take over our computers that has been occuring the past few months.--===========================_ _= 1633911(13157)1086874053
Content-Type: message/rfc822Received: from toip1.bellnexxia . net (<209.226.175.84>)
by tomts30-srv.bellnexxia . net
(InterMail vM.5.01.06.10 201-253-122-130-110-20040306) with ESMTP
id <20040610132730.NROE13157.tomts30-srv.bellnexxia.net@toip1.bellnexxia . net>;
Thu, 10 Jun 2004 09:27:30 -0400
Received: from 52.206-201-80.adsl.skynet . be (HELO jvdarijt . net) (80.201.206.52)
by toip1.bellnexxia . net with SMTP; 10 Jun 2004 09:17:52 -0400
From: rpicardi1@chartermi .n et
To: adlon@sympatico . ca
Date: Thu, 10 Jun 2004 13:07:27 GMT
MIME-Version: 1.0
Subject: Was Deutschland braucht, sind deutsche Kinder!
Importance: Normal
X-Mailer: Mail-SMTP V1.72
X-Priority: 3 (Normal)
Message-ID: <c9d35600e2844f.edfbe.qmail@chartermi . net>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"Lese selbst:
http: / / www .widerstandnord . com/aktionsbuero/kamp_auslstopp/kamp_heimreise . htmThe html link in the last line contains the location to install an instant mess to your computer.Links broken for everyone's protection.SRV Ron

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Please everyone! Don't post headers that may contain links to a website containing a virus unless you do what Ron did, and break the links to all addresses. Or you will spread the virus to everyone here!! If you are not sure how to do this "DO NOT POST THE EMAIL HEADER" I can not emphasize that enough! Also for those who are curious, don't put the links back together to see what happens, or as Ron said, it will cause an instant mess to your computer. Also by posting these headers you are making your email address public knowledge, so unless you like spam, you should only give this information out to those you communicate with and trust. The public does not need to know!!

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

The links are harmless unless followed.-Jeff

Union Pacific fan.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

The first thing that amazes me is why other human beings (if that's what they are) can send a virus to someone who has done them no harm, and to whom they don't know. Who are they? Where do they do it from? And why do they do it?
The second thing that amazes me is WHY-O-WHY do people still get infected, and not just private individuals but big companies as well?And is there a connection between spammers and virus senders? WHAT IS THEIR PURPOSE?Mike

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Well, I for one, knows this, virus attacks is the terrorism of the future, if not already now.Terror factions could soon use viruses to try and shut down power stations, mess up ralroad systems, etc etc etc, even launch a nuke! /JonatanSteam rules!

Never trust computers. If you do, they will betray you.I'm the steam freak, ph34r me!!

My E-mail jonatan.gronoset@telia.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

What I posted above was part of the body text of the suspect returned mail. There was four times the header info above in that example. It looks like it had been bounced and forwarded through several infected computer in an effort to hide its source. Given the "broken" html link it contained, it looked like a recipe for disaster had this mail been opened.Here is all of the text in the first part of the body text;"Content-Type: text/plainThis Message was undeliverable due to the following reason:The user(s) account is temporarily over quota."Translation, the inbox on the mail server was full.There was additional information in the body text about two other sites where this mail was bounced around. It, of course, was full of links to servers and other sites.Further warning, Your antivirus program is unlikely to block this type of mail as there was no attachment. I've have also had several get passed through with attachments."Also by posting these headers you are making your email address public."Few spammers bother to harvast email addresses this way. It's way too much work when they can just buy them from several of the popular providers, the ones that constantly mail you the coasters, or use a virus attachment in e-mail to harvast larger batches of them from an address book.The few spam ones that I get, Charter doesn't sell it's e-mail accounts, may have been harvasted from such a post, or, more likely, from the readme file on uploaded stuff.If you don't open or respond to spam, the spammers eventually figure out that they are wasting their time sending spam to that address. Open or respond to one and you will soon be swamped in the stuff.SRV Ron

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

>Few spammers bother to harvast email addresses this way. It's way too much work when they can just buy them from
>several of the popular providers, the ones that constantly mail you the coasters, or use a virus attachment in e-mail
>to harvast larger batches of them from an address book. Ron,There are spam gangs that ONLY harvest email addresses from web sites, I still get spams tatgeting addresses that used to be on my web site.
Its not a lot of work as programs called spiders do it for you.

Derek
EngMod@sgrail.org
www.sgrail.org

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

>Few spammers bother to harvast email addresses this way.
>It's way too much work when they can just buy them from
>several of the popular providers, the ones that constantly
>mail you the coasters, or use a virus attachment in e-mail
>to harvast larger batches of them from an address book. Spiders, Web-bots, and crawlers make this an automated process. It's actually more work to buy a list.>If you don't open or respond to spam, the spammers
>eventually figure out that they are wasting their time
>sending spam to that address. Open or respond to one and you
>will soon be swamped in the stuff. No, spammers don't check the validity of their lists. The fact that you don't open it, or respond makes no difference.One tactice that I find humorous lately, is the spam filters advertising the "bounce back" feature, that sends a fake "no such address" message. Presumably, the idea is that this will appear to come from your ISP. This is totally useless. Spammers will spam from an address, then move on to another address. Any "bounce" will not get back to them. But even if it did, all you are doing is announcing that you are at that address! An ISP will "bounce" an invalid address as soon as the delivery attempt is made. If a "bounce" is returned a period of time after delivery, you are waving a flag that you are indeed home. If you are going to "bounce", you might as well just click the "unsubscribe" link. -Jeff

Union Pacific fan.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I have received about 25 of these over the past few days. Fortunately my AV stops them dead and blows them out of the water. Most of them have supposedly been from some postmaster@xxxxxxx.xxx from a site that I have never been to or even heard of, let alone sent mail to. Beer is not a matter of life and death. It is much more serious than that.
mervyn.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Mervyn I hope you have a firewall too.
Ron, Like me you are lucky enough to have Norton's Internet Security 2004 which literally does everything including blocking popups, but may I warn folks about having additional block popup software to Norton's 2004 own software, as this can interfere with the smooth running of both Norton's and Windows XP. For example, I could not install programs with a popup software program installed plus Norton's sercurity software.
Is defaultpage.com an illegal site?Mike

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

>Is defaultpage.com an illegal site? No, it's a search portal.-Jeff

Union Pacific fan.

Alert | IP

[ Home | MSTS Forum | MSTS FAQ | File Library ] Copyright © 2004 by Nels Anderson. All Rights Reserved.