Online Hygiene News: Virus / Hacking / Spam Notes & Alerts

[stu neville]

Anyone else had this?

For those of you who don't know, "WTC" stands for The World Trade
>>>>Center....which makes this virus really dangerous because people
>>>>will open it right away, thinking it's a story relating to 9/11.
>>>>> >BIG TROUBLE!!! Do not open "WTC Survivor". It is a big virus
>>>>>that will erase your whole "C" drive. It will come to you in the
>>>>>form of an E-mail from a familiar person!! I repeat, a friend
>>>>>sent it to me, but called and warned me before I opened it. He
>>>>>was not so lucky and now he cannot even start his computer!
>>>>> >Forward this to everyone in your address book. >I would rather
>>>>>receive this 25 times than not at all. >So, if you receive an
>>>>>E-mail called "WTC Survivor" do NOT open it!!! Delete it right
>>>>>away! This virus removes all dynamic link libraries (.dll files)
>>>>>from your computer. >PLEASE FORWARD THIS MESSAGE TO OTHERS!!!
>>>>

Seems a little chain letter-esque to me: anyone know if it's legit?

Stu

 

[stu neville]

..and to answer my own post

McAfee have already been there and done that.

However, playing the onion game, note the date that McAfee released the notice.

Now think about the date that the event in question actually happened.

Now that's Fortean...

Stu

 

[NilesCalder]

Meep! :eek!!!!:

The virus appears to predate the attack by at least 3 days.

This must be a typo since the text of the warning is dated October 28th 2001.

Either that or this thread needs to be moved to Conspiracy ASAP.

Niles "Not sure which" Calder

 

[stu neville]

Re: ..and to answer my own post

McAfee have already been there and done that.

However, playing the onion game, note the date that McAfee released the notice.

Now think about the date that the event in question actually happened.

Now that's Fortean...

Stu

*EDIT* Except that it's a US site, so it reads November 6th and 7th, not 11th June or July. Should have noticed, really, shouldn't I?

Oops. Mea Culpa. Thanks to all those who wrote in .

 

[NilesCalder]

Damn yanks why can't they use the same system as everyone else???

Niles "DD/MM/YYYY" Calder

 

[liveinabin]

Or even the Japanese method YY/MM/DD


At least thats more logical than MM/DD/YY

 

[Glensheen'sGirl~]

Why is that more logical?

When I say the date I say September 15, 2002 (mm/dd/yyyy) not 2002, September 15 (yyyy/mm/dd) or 15 September, 2002 (dd/mm/yyyy).

Makes more sense to me to use mm/dd/yyyy. The Japanese way makes the least sense of the three. Every once in a while I might say it dd/mm/yyyy, but not very often.

 

[Cult_of_Mana]

To British English speakers it makes more sense to start with the smallest unit, ie the day, and work ones way up. The Japanese appear to have done this in reverse. Both systems employ a logical use of superlatives. The American system does not.

 

[Anonymous]

Why is that more logical?

When I say the date I say September 15, 2002 (mm/dd/yyyy) not 2002, September 15 (yyyy/mm/dd) or 15 September, 2002 (dd/mm/yyyy).

Makes more sense to me to use mm/dd/yyyy. The Japanese way makes the least sense of the three. Every once in a while I might say it dd/mm/yyyy, but not very often.

So do tell, what is 05/06/02? Unless everyone uses the same system how are you supposed to know whether it's the 5th June 2002 or 6th May 2002?

 

[Anonymous]

On the subject of viruses (or should that be virii?), has anybody recieved what appears to be porn spam with an attachment called incest-family-dvd.exe?
I've had at least four of these in the past week, all on the same email address. I've deleted them all, along with the attachment, so I can't give you the exact message, but it is quite offensively explict. It's (supposedly) advertising a porn dvd with incest images, and the attachment is (supposedly) a sample.
Unusually for spam, this doesn't have a link in the message, which is why I think it's a virus, but the AV sites don't have any info on it.
Doing a bit of googling has told me that the message has been copied directly from porn sites (v. unpleasant ones claiming to carry incest and paedo images and text). So I'm wondering that, if this is really a virus, might it not be an attempt by some anti-porn hacker to wreck the computers of people who are interested in the worst types of internet porn?

 

[Anonymous]

I delete any attachment that I am not expecting unless the sender verifies it to me.

Any form of Chain email is deleted immediately and a sarcastic email is sent to the weak minded fool who decided to send it to me.

 

[Anonymous]

The easiest way to avoid a virus is to not take any attatchments from /strangers/idiots/chriswsm/and those you dont expect.

Dont give your email adress out to anyone you dont trust and dont post it on the web, not even nice forums like this one.

Also dont take any HTML emails either, not only are they annoying theyr usually spam.

And if you do get spam bounce them back rather than delete them as it slows the senders server down and it make them think your adress doesnt exhist and they will take you off there mailing list.

 

[Anonymous]

And if you do get spam bounce them back rather than delete them as it slows the senders server down and it make them think your adress doesnt exhist and they will take you off there mailing list.

So how do you bounce back emails, without opening them and discovering if they are spam or not? Replying to spam in any way - including (especially! clicking on that "unsubscribe me" link at the bottom - simply confirms your email addy as 'live'; the spammers then add it to the lists which they sell to each other. The only way I know of blocking spam without handing them your address is to block known spam addresses/domains. But this isn't much use, as they continually create new addresses anyway.
A long-term strategy would be for everyone to forward every spam to 'postmaster' or 'abuse' @ whatever the originating ISP is. Since some spammers nowadays can disguise their original addresses (although you might be able to find that info buried somewhere in the headers), that won't work in every case. However, given enough complaints, the ISPs might just get their act together on this.
More info on fighting spam can be found on euroCAUCE .

 

[_schnor]

So how do you bounce back emails, without opening them and discovering if they are spam or not?

It's suprisingly simple actually, what you can do is reply to spam with a dummy delivery report failure like the following...

This report relates to your message: 
Subject: spam,
  Message-ID: "BLAH"
  To: "RECIPIENT"

Your message was not delivered to   
whatever
        for the following reason:
        Incompatibility between two sites on the route of the message
        (please contact local administrator)
        Authorisation failure at site "MASTER SERVER" for
        recip "RECIPIENT" Reason: This route
        is prohibited: (policy none) 

***** The following information is directed towards the local administrator
***** and is not intended for the end user
* 
* DR generated by: "SYSADMIN"
*         in /ADDR
*         at "DATE"
*
* Converted to "PORT" at "SYSADMIN"
*         at "DATE"
*
* Delivery Report Contents:
*
* Subject-Submission-Identifier: "[/MSG ID]
* Content-Identifier: "SPAM"
* Original-Encoded-Information-Types: ia5-text
* Content-Correlator: Subject: "SPAM",
*                   Message-ID: "WHATEVER"
*                   To: "RECIPIENT" "<ADDRESS>"
* Recipient-Info: "ADDRESS",
*         MSG ID;
*         FAILURE reason Unable-To-Transfer (1);
*         diagnostic No-Bilateral-Agreement (17);
*         supplementary info "Authorisation failure at site
*         "SYS ADMIN" for recip
*         "RECIPIENT" Reason: This route is
*         prohibited: (policy none)";
****** End of administration information

Just replace "STUFF LIKE THIS" with random stuff, the mail scanners will assume it's a delivery failure and block your address

you don't have to reply but C/P the incoming address, and as for whether or not somethings spam 99% of the time it's pretty obvious

 

[Daftbugger1]

I'm suprised that you got as far as finding that it had an attachment. All porn crap that I get I automatically delete. Although I have a horrid feeling that I may have deleted some proper e-mails as well.

 

[Anonymous]

Thanks Schnor, I'll give that one a go.
Naturally, I never open strange attachments. However, it's not so easy to tell which mail is spam on the particular address I'm talking about, as it's the main email address for an information network and consequently gets a lot of mail from strangers.
To illustrate, here's a selection of subject lines from recent genuine emails from strangers:
Hello,
Thank you
Re: Night of the Hunter's Moon
Directions
WC facilities
Hi there!
HIYA!
(none)
dog
info

(Yes, I know, there's a haiku in there somewhere)

Lots of spam that I've had (including porn spam) have had very similar subject lines.

 

[Anonymous]

The easiest way to avoid a virus is to not take any attatchments from /strangers/idiots/chriswsm/and those you dont expect.

Oh well, at least im not a stranger or an idiot.

Hang on Mr C! You have been rather appreciative of some of my attachments in the past. Admit it, or I will tell Mrs C. :hmph:

 

[Anonymous]

You can bounce spam emails using Mailwasher (freeware), although I have heard that bouncing emails can cause problems on some servers.

My best tip for avoiding unsolicited email is don't get a hotmail or .msn account; spam-magnets the pair of them.

 

[Anonymous]

I just got a good one!

You have won a personal stereo cassette player. We just need to verify your full address details so that we can send your prize

Yeah right, cos I give my full address out to every unidentified Tom Dick and Harry that asks for it

 

[Pinklefish]

http://news.bbc.co.uk/1/hi/technology/3684552.stm

Virus writers focus on image bug

A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers.

The bug only came to light last week, but code is now circulating that could be used to attack vulnerable machines.

Some security experts said conditions were right to turn the bug into a widely exploited problem.

But others said there was still time to patch machines and ensure that virus writers were prevented from scoring a big success.

Picture problems

Microsoft issued a critical security alert last week telling users that there were problems with the way Jpeg images are handled by Windows and many other programs it makes.

The alert said that, theoretically, a malicious attacker could take over a vulnerable machine using a carefully crafted image that contained code to exploit the bug.


VULNERABLE PROGRAMS
Windows XP
Windows XP Service Pack 1
Windows Server 2003
Internet Explorer 6 SP1
Office XP SP3
Office 2003
Digital Image Pro 7.0
Digital Image Pro 9
Digital Image Suite 9
Greetings 2002
Picture It! 2002
Picture It! 7.0
Picture It! 9
Producer for PowerPoint
Project 2002 SP1
Project 2003
Visio 2002 SP2
Visio 2003
Visual Studio .NET 2002
Visual Studio .NET 2003

At the time the alert was issued, example code to exploit the bug had not been seen.

However, sample code written for the bug appeared earlier this week, leading some to speculate that a virus written to use it would follow soon.

This could mean that users find their machine under attack when they view images on the web or when their e-mail program previews images contained in messages.

"This is the virus equivalent of a harmonic convergence," said David Perry, from anti-virus firm Trend Micro.

He said all the conditions were right to make any virus that used the exploit code a big hitter.

"It's been a long time since the last major virus outbreak," he said. "That's a major factor. How many people have let their guard down?"

"Also," he said, "it's a big vulnerability and it affects a lot of different people and it would be easy to put on the web or any of a number of different things."

He said porn sites or those happy to spread spyware could be sources of virus carrying images.

No panic

He said one other reason for suspecting that a virus to exploit the Jpeg bug was imminent was the fact that the annual Virus Bulletin conference runs this week.

"There's almost always a virus released during the Virus Bulletin conference because all the virus experts are away from home," he said.

But Graham Cluley from anti-virus firm Sophos said there was no need to panic.

"At the moment no-one is exploiting the bug to deliver malicious code," he told BBC News Online. "It is purely being done as a 'proof of concept'."

He urged people to apply patches before a virus was written to exploit the bug.

"Microsoft has had its patches out for more than a week now," he said, "so home users who have switched to automated updates should already have downloaded the fix."

Security experts pointed out that machines patched with the SP2 update to XP, which closes many commonly exploited vulnerabilities, could be at risk from the Jpeg virus if they used other programs that still contained the loophole.

In all, more than a dozen programs are susceptible to the Jpeg exploit.

Advice from analysts Gartner said the Jpeg bug could be hard for companies to protect themselves against because most computers had several versions of the vulnerable component installed.



----------------------------

If you haven't already, now's the time to switch to Firefox

 

[Leaferne]

If you haven't already, now's the time to switch to Firefox.

Very good advice; it is my favourite browser. On my Mac. (gave up on Safari because it's too fussy)

*smiles complacently*
Of course, I should NOT be smiling because if there's a new virus in the wings, every dumbass kid at the uni (that would be most of them, Bob) is going to come down with this virus tout de suite and start pestering us to fix their fecking computers, which should NOT happen if they've all been installing SP2 as we've been trying to bully them into doing.

 

[Leaferne]

If you haven't already, now's the time to switch to Firefox.

Very good advice; it is my favourite browser.

*complacent smile*

 

[Anonymous]

Very good advice; it is my favourite browser.

*complacent smile*

Of course, 'complacent smile.jpg' could also have been infected.

Oh Lord! Everyone, close you eyes. Don't look. Don't look!

 

[Leaferne]

Of course, 'complacent smile.jpg' could also have been infected.

Oh Lord! Everyone, close you eyes. Don't look. Don't look!

Nah, I don't see OSX on that list. *smiles sweetly*

I hate it when clients call it "ozz ex"

 

[oll_lewis]

well seeing as microfoft found it they wouldn't be making patches for macs would they...

Now, since they've has it under their hats for over a year 'studying it', microsoft might have been spending lots of time developing viruses that are excluseively mac compatable useing the process.

I wonder though, if useing a different browser really would stop a virus hidden in a jpg (or i supose technicly any other picture format) from getting onto your computer, one would presume that once it gets saved on your computer it will not really care what browser you have (not that i know how fire fox works but i presume it is capeable of downloading, showing or saving Jpgs like any other browser)

 

[Anonymous]

...

I wonder though, if useing a different browser really would stop a virus hidden in a jpg (or i supose technicly any other picture format) from getting onto your computer, one would presume that once it gets saved on your computer it will not really care what browser you have (not that i know how fire fox works but i presume it is capeable of downloading, showing or saving Jpgs like any other browser)

Depends on whether the jpeg-virus exploits something browser specific, like Active-X, to do its business, I suppose.

 

[liveinabin]

I have a spam e-mail account, one I give to companies I order from and that kind of thing. I get loads of spam and virus filled e-mails there. I open all of them just for a laugh and nothing has infected my eMac running osX yet.

And no I'm not buying porn!!

 

[giantrobot1]

I use Linux.

I may be a geek, but at least I don't have to put up with this crap!

:goof:

 

[Pinklefish]

Neither do windows users if they take a few basic precautions.

 

[Graylien]

Linux

Linux makes my head hurt. I tried it a couple of times but couldn't even get my modem drivers installed properly, and all the Linux forums seem to be full of people speaking in some baffling alien language. I wish they'd bring out a version that everyday folk could understand.