28 Nov
2001
28 Nov
'01
10:16 a.m.
According to what I have read about the virus, it "replies" to unread
emails. The copy I got was a re: to "RE: Rubber Restorer", which was a
thread a few weeks ago about restoring printer feeder rollers. I did post in
that thread. I would venture that everyone on the CC list who got a copy had
it titled in re: something they previously posted. I guess we have a second
reason to be upset with Mr. (or Ms.) Ring: s/he didn't read at least one of
our brilliant email posts.
BTW, can anybody check to see if Ring is a member of the list?
-----Original Message-----
From: Sellam Ismail [mailto:foo@siconic.com]
Sent: Wednesday, November 28, 2001 2:32 PM
To: classiccmp(a)classiccmp.org
Subject: Re: Spam from _sring(a)uslink.net?
<snip>
Curious, as I use this account exclusively to receive CC messages, and
mostly post to the list from it. <snip>
28 Nov
28 Nov
12:36 p.m.
On Wed, 28 Nov 2001, Feldman, Robert wrote:
it titled in re: something they previously posted. I
guess we have a second
reason to be upset with Mr. (or Ms.) Ring: s/he didn't read at least one of
our brilliant email posts.
To top it all, I just got a copy from
John R. Keys Jr. <_jrkeys(a)concentric.net> !!
Notice that the virus prepends an unsdersore in front of an otherwise
legitimate address.
QUESTION: Is the virus necessarily on HIS computer, or has somebody
written any viruses that forge somebody else's return address (from
another message in the same mailbox),
This one, the "payload" was in:
README.mp3.scr
I've also gotten earlier today from other mails a couple with a payload
named:
SM3SONG.mp3.scr
And people can't understand why I would prefer PINE on a Unix shell
account over OUTLOOK (aka MS virus transfer protocol)
--
Grumpy Ol' Fred cisin(a)xenosoft.com
2:16 p.m.
A non-text attachment was scrubbed...
Name: not available
Type: text
Size: 388 bytes
Desc: not available
Url :
http://www.classiccmp.org/pipermail/cctalk/attachments/20011129/b125f7d1/at…
3:54 p.m.
New subject: Worm Alert (Re: Spam from _sring@uslink.net?)
There is a virus / worm going around. Among other things, you can spot it
because it seems to replace the sender in the "Reply To:" with one starting
with an underscore. At least two of them appropriated subjects related
to messages I posted on ClassicCmp -- one referring to the PDP/11-24 power
supply stuff and another relating to TU10's.
Norton AV on my machine caught messages with it on my way in, and said:
is infected with the W32.Badtrans.B@mm virus.
The Symantec page
http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.h…
has information on it.
"The worm writes email addresses to the %System%\Protocol.dll file to
prevent multiple emails to the same person. Additionally, the sender's
email address will have the "_" character prepended to it, to prevent
replying to infected mails to warn the sender (eg user(a)website.com becomes
_user(a)website.com)."
Jay
At 01:16 AM 11/29/2001 +0000, you wrote:
As have I, apparently replying to a message that I just posted. It's now
in the bit bucket...
-tony
---
Jay R. Jaeger The Computer Collection
cube1(a)home.com visit http://members.home.net/thecomputercollection
> it titled
in re: something they previously posted. I guess we have a
second
> reason to be upset with Mr. (or Ms.) Ring:
s/he didn't read at least
one of
our
brilliant email posts.
To top it all, I just got a copy from
John R. Keys Jr. <_jrkeys(a)concentric.net> !! 
3:22 p.m.
On Wed, 28 Nov 2001, Fred Cisin (XenoSoft) wrote:
Notice that the virus prepends an unsdersore in front
of an otherwise
legitimate address.
Guess we could use this to our advantage with mail filters?
And people can't understand why I would prefer
PINE on a Unix shell
account over OUTLOOK (aka MS virus transfer protocol)
procmail and pine...gotta be the best combination I've found yet. One of
these days I'll give mutt a try too.
-Toth
29 Nov
29 Nov
2:59 a.m.
On Wed, Nov 28, 2001 at 03:36:25PM -0800, Fred Cisin (XenoSoft) wrote:
This one, the "payload" was in:
README.mp3.scr
I've also gotten earlier today from other mails a couple with a payload
named:
SM3SONG.mp3.scr
After feeling left out, I finally got a copy under the guise of
"YOU_ARE_FAT!.MP3.scr". It was from a different mailing list.
And people can't understand why I would prefer
PINE on a Unix shell
account over OUTLOOK (aka MS virus transfer protocol)
Where I work there are all kinds of stupid restrictions--such as
thinking that the internet consists of only e-mail and the web, and
only having proxies to do those protocols. But there is nothing
saying that Outlook or Javascript are dangerous, they are encouraged.
I will concede, however, that I have not gotten this virus (yet)
through my work e-mail. Their scanning at the servers sometimes
works.
-kb
6:03 a.m.
S. Ring, IIRC, is Stephanie Ring. She is/was a list member.
I'm using Outlook 2000 with the latest Microslop patches/security updates
and the latest version of ZoneAlarm, 2.6.357, so I avoided infection.
Since the attachment was quarantined, the email I received has a seemingly
blank body and no apparent attachment. The subject line is:
Re: RE: SWTPc and Microdata (WARNING - LONG EMAIL STILL),
which is a reply to an email I sent over a year ago to Jay West (hello,
Jay), which he replied to by sending a new email with a different subject
line. I'm guessing that Jay still had my original unreplied to email?
Checking the properties of the this email does show "size: 30KB (Contains 1
included file(s))".
And, here's the header from the email, however I xz-munged the email
addresses. Note the underscore in the "From:":
Return-Path: <xwest(a)xtseinc.com>
Received: from opal.tseinc.com (opal.tseinc.com [209.83.143.19])
by mlynk.com (8.9.3/8.9.3) with ESMTP id VAA14949
for <zwhdawson(a)mlynkz.com>om>; Wed, 28 Nov 2001 21:59:38 -0500
Received: from aol.com (user(a)stl-26.tseinc.com [209.83.137.26])
by opal.tseinc.com (8.9.3/8.9.3) with SMTP id TAA73484
for <zwhdawson(a)mlynkz.com>om>; Wed, 28 Nov 2001 19:36:03 -0600 (CST)
(envelope-from xwest(a)xtseinc.com)
Date: Wed, 28 Nov 2001 19:36:03 -0600 (CST)
Message-Id: <200111290136.TAA73484(a)opal.tseinc.com>
From: "Jay West" <_xwest(a)xtseinc.com>
To: zwhdawson(a)mlynkz.com
Subject: Re: RE: SWTPc and Microdata (WARNING - LONG EMAIL STILL)
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
Status:
My sister wasn't so lucky in avoiding the hit, so I'll have to go clean up
her system. The infected email in her case came from an eBay user. BTW,
FWIW, S. Ring is or was an eBay member.
'til next time,
Bill
-> On Wed, Nov 28, 2001 at 03:36:25PM -0800, Fred Cisin (XenoSoft) wrote:
-> > This one, the "payload" was in:
-> > README.mp3.scr
-> > I've also gotten earlier today from other mails a couple with a payload
-> > named:
-> > SM3SONG.mp3.scr
8 a.m.
At 08:59 AM 11/29/01 -0500, you wrote:
After feeling left out, I finally got a copy under the
guise of
"YOU_ARE_FAT!.MP3.scr". It was from a different mailing list.
Got that one too.
--------------------------------------------------------------
Carlos E. Murillo-Sanchez carlos_murillo(a)nospammers.ieee.org
8273
days inactive
8274
days old
7 comments
8 participants
participants (8)
-
ard＠p850ug1.demon.co.uk -
cisin＠xenosoft.com -
cmurillo＠emtelsa.multi.net.co -
cube1＠home.com -
kentborg＠borg.org -
Robert_Feldman＠jdedwards.com -
tothwolf＠concentric.net -
whdawson＠mlynk.com