Re: Virus
From: Invisible Dance (dark.apostle_at_mindspring.com)
Date: 10/05/03
- Next message: Michael Jennings: "Re: I need help... mass mailing..."
- Previous message: PCR: "Re: Microsoft Security Bulletin MS03-040 - 828750"
- In reply to: Andy: "Virus"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 05 Oct 2003 02:33:47 GMT
If the message was in HTML format, looked like a Microsoft security
bulletin, and directed you to "Run attached file, it was sent from an
infected computer system or network. The attachment contains the 'swen'
worm.
[ Symantec, the publisher of Norton AntiVirus, has a description of the
worm, how to remove it, and removal tools at
http://www.symantec.com/avcenter/venc/data/w32.swen.a@mm.html . Other
publishers of antivirus programs have similar webpages. Note well, removing
this worm after your system has been infected is not a simple task.]]
This worm has two main effects, and some secondary effects
I. Main effects
A. It infects vulnerable systems and networks.
B. It generates a FLOOD of infected e-mail that is sent to e-mail
addresses it harvests from infected machine and networks. These infected
e-mails are of two types
1. An HTML message that looks like a legitimate Microsoft Security
Bulletin; the hotlinks in this message are valid Microsoft links, and will
even lead you to a description that will allow you to identify this e-mail
as bogus. The message has an attached 104 KByte file that contains the
worm. If you don't have all appropriate Microsoft security patches and
Service Packs installed, it may be possible for your system to be infected
EVEN IF YOU DON'T OPEN THE MESSAGE. So far, the body of this message is
always the same, though the Subject and From lines differ widely. This
message, so far, can be easily be blocked by detecting the string 'Run
attached file' in the body ( in fact, it would be a good practice to
consider ANY e-mail that contains this string AND has an attachment to very,
very likely to carry an infection.
2. A plain text message that purports to be a notification of an
'Undeliverable e-mail', with an attachment that purports to be a copy of the
undeliverable e-mail; this attached file is 104 KBytes long and contains the
worm. The Subject line, From line, and body present in thousands of
combinations, and probably will continue to mutate. Even worse, real e-mail
addresses harvested from infected systems and networks are tagged onto this
type of message, causing one of the secondary effects.
II. Secondary effects
A. Spam effect
1. Mailboxes with an e-mail address that has been harvested from
infected systems and networks begin to be flood with infected e-mail.
[Personal example: my machines are not infected, but this worm began to
flood my mailbox 17SEP03. I now receive more than 1500 infected e-mail
messages per day. I must empty my mailbox every 5 minutes, 24/7 to avoid
the possibility of having legitimate e-mail bounced. I had to install an
application just to segregate the cleaned, previously infected e-mail
from legitimate e-mail (standard spam blockers can't do this.)
B. Notifications from mail services that DO scan for infected
messages, but unfortunately do not realize that the e-mail addresses given
for the sender are either bogus or e-mail addresses harvested by the worm.
Thus, completely innocent mailboxes have insult added to injury.
****
What can you do locally as an individual (i.e. in a SmallOfficeHomeOffice
environment, and /or as a recreational user)?
#1. You can use a remote virus scan from one of the antivirus program
publishers
THEN
#2. You can remove any infections discovered
THEN
#3. You install a good antivirus program, keep it active, keep the virus
definitions up-to-date (at the moment you should update these definitions
EVERY day), and set to scan all incoming e-mails and downloads.
THEN
#4. You can install all appropriate Microsoft security patches and Service
Packs.
THEN
#5. You can consider additional security (DCHP server, firewall, boric acid
[for roaches], .....
If you begin to be flooded with these infected messages, COMPLAIN to your
ISP; send them this URL
http://xtra.co.nz/products/0,,8969,00.html of an ISP that scans incoming
e-mail before passing it to a mailbox. Ask for an increased mailbox size
(if you are getting 1500 of these infected e-mails per day, you will need a
mailbox size over 150 MBytes just to avoid the necessity of completely
emptying it EVERY DAY. Ask about the implicit duty of the ISP to provide
reliable e-mail service, and if they have received notification of any
pending class actions you might join. Ask if they will unbundle their
services so you can opt out of e-mail service and save that cost. That's
about
all you can do about the e-mail flood; only your ISP or other e-mail
provider can come close to solving this problem.
When the e-mail flood becomes too painful, find an ISP or other e-mail
provider that DOES scan and discard infected e-mail before passing it to
your mailbox, and then change to that ISP and/or e-mail provider. Changing
your e-mail address is no solution; as soon as your new e-mail address is
harvested from an infected system or network, the problem starts again.
When a mailserver is scanning and not just deleting infected e-mail, but is
also sending an e-mail to notify the sender, write the administrator a nasty
note asking them to stop sending these notices.
****
That's about it; you can proof your system against infection, but only
changes at the mailserver level can stop reception of a flood of infected
e-mails and increasing numbers of inappropriate notices that you've sent
infected e-mail.
Phil Weldon, pweldon@mindspring.com
-- Invisible Dance, dark.apostle@mindspring.com "Andy" <ajh30@juno.com> wrote in message news:02fe01c38a9a$9e6a5030$a101280a@phx.gbl... > I have received quite a few Microsoft Update e-mails > lately, and when I opened the most recent attachment, the > Norton virus indicator came on. Has anyone else had this > problem? I am assuming that either someone is forwarding > the virus through the Microsoft Updates or there is > somthing in the Update that triggers the virus message.
- Next message: Michael Jennings: "Re: I need help... mass mailing..."
- Previous message: PCR: "Re: Microsoft Security Bulletin MS03-040 - 828750"
- In reply to: Andy: "Virus"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
