Author
|
Topic: virus: Re: does it? (Read 978 times) |
|
Walter Watts
Archon
Gender: 
Posts: 1571
Reputation: 8.61
Rate Walter Watts
Just when I thought I was out-they pull me back in
  
|
 |
virus: Re: does it?
« on: 2004-03-22 08:57:13 » |
 |
yours?
attached: update_document.exe
|
Walter Watts
Tulsa Network Solutions, Inc.
No one gets to see the Wizard! Not nobody! Not no how!
|
|
|
Walter Watts
Archon
Gender:
Posts: 1571
Reputation: 8.61
Rate Walter Watts
Just when I thought I was out-they pull me back in
|
|
Re:virus: Re: does it?
« Reply #1 on: 2004-03-22 09:48:11 » |
|
I didn't send this.
How do these virus kids and spammers and other assholes spoof your address like this?
I NEVER open attachments, not from anybody, so it didn't affect me.
I hope no one else was affected.
Walter
|
Walter Watts
Tulsa Network Solutions, Inc.
No one gets to see the Wizard! Not nobody! Not no how!
|
|
|
rhinoceros
Archon
Gender:
Posts: 1318
Reputation: 8.06
Rate rhinoceros
My point is ...
|
|
Re:virus: Re: does it?
« Reply #2 on: 2004-03-22 11:51:07 » |
|
[Walter]
I didn't send this.
How do these virus kids and spammers and other assholes spoof your address like this?
I NEVER open attachments, not from anybody, so it didn't affect me.
I hope no one else was affected.
[rhinoceros]
The attachment seems to contain the "I-Worm/Netsky.C" virus. (Lucifer, you might want to remove that attachment from the BBS).
The way it works is rather simple. Assuming Walter's computer is clean, someone else was infected, who had both Walter's and the mailing list's email adresses in their address book. Then the virus started sending out emails from that person's machine, putting random addresses found in the address book in the "To" and "Reply to" fields of the messages.
The account from which the message was really sent can be traced, to some degree, by examining the full headers of the message (which are not visible here).
|
|
|
|
|
|
|
simul
Adept
Gender:
Posts: 614
Reputation: 7.53
Rate simul
I am a lama.
 
|
|
Re: virus: Re: does it?
« Reply #4 on: 2004-03-22 12:09:34 » |
|
It's trivial to spoof an address. And until more people implement SPF (sender permitted from), it will remain trivial.
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
First, read Bruce Sterling's "Distraction", and then read http://electionmethods.org.
|
|
|
Walter Watts
Archon
Gender:
Posts: 1571
Reputation: 8.61
Rate Walter Watts
Just when I thought I was out-they pull me back in
|
|
Re: virus: Re: does it?
« Reply #5 on: 2004-03-22 13:42:00 » |
|
I have no virus, and my virus pattern file comes in real-time.
Rhino's assumption about my computer being clean, and his explanation for the header
spoof was right on.
Thanks for the suggestion, though.
good to hear from ya--been a while.
Walter
Kalkor wrote:
> 1. Virus takes over machine
> 2. Virus looks in emails on machine
> 3. Virus sends emails to just about any email address it finds on that
> machine (yours, for instance, if you ever sent someone an email)
>
> Happy days, WW ;-}
>
> Kalkor
>
> -----Original Message-----
> From: owner-virus@lucifer.com [mailto:owner-virus@lucifer.com]On Behalf
> Of Walter Watts
> Sent: Monday, March 22, 2004 6:48 AM
> To: virus@lucifer.com
> Subject: Re:virus: Re: does it?
>
> I didn't send this.
>
> How do these virus kids and spammers and other assholes spoof your address
> like this?
>
> I NEVER open attachments, not from anybody, so it didn't affect me.
>
> I hope no one else was affected.
>
> Walter
>
> ----
> This message was posted by Walter Watts to the Virus 2004 board on Church of
> Virus BBS.
> <http://virus.lucifer.com/bbs/index.php?board=61;action=display;threadid=300
> 69>
> ---
> To unsubscribe from the Virus list go to
> <http://www.lucifer.com/cgi-bin/virus-l>
>
> ---
> To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
--
Walter Watts
Tulsa Network Solutions, Inc.
"Pursue the small utopias... nature, music, friendship, love"
--Kupferberg--
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
Walter Watts
Tulsa Network Solutions, Inc.
No one gets to see the Wizard! Not nobody! Not no how!
|
|
|
Walter Watts
Archon
Gender:
Posts: 1571
Reputation: 8.61
Rate Walter Watts
Just when I thought I was out-they pull me back in
|
|
Re: virus: Re: does it?
« Reply #6 on: 2004-03-22 13:55:09 » |
|
Can you imagine how frustrating it must be for non-techies to keep their computer free of viruses and keeping important
data safe and backed up (family pictures, mp3's, documents, email, etc.)
I still have stuff on this PC (something like 7 or 8 pc's later) that I had on my first pc. And I've NEVER had a computer
virus. How's that for being an anal-retentive, old-timer, DOS-schooled computer user.
Thanks for the reply,
Walter
Erik Aronesty wrote:
> It's trivial to spoof an address. And until more people implement SPF (sender permitted from), it will remain trivial.
> ---
> To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
--
Walter Watts
Tulsa Network Solutions, Inc.
"Pursue the small utopias... nature, music, friendship, love"
--Kupferberg--
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
Walter Watts
Tulsa Network Solutions, Inc.
No one gets to see the Wizard! Not nobody! Not no how!
|
|
|
Kalkor
Magister
Gender:
Posts: 109
Reputation: 6.78
Rate Kalkor
Kneading the swollen donkey...
|
|
RE: virus: Re: does it?
« Reply #7 on: 2004-03-22 16:09:26 » |
|
Ah, but when did I say virus takes over YOUR machine?
;-}
[WW]
I have no virus, and my virus pattern file comes in real-time.
Rhino's assumption about my computer being clean, and his explanation for
the header
spoof was right on.
Thanks for the suggestion, though.
good to hear from ya--been a while.
Walter
Kalkor wrote:
> 1. Virus takes over machine
> 2. Virus looks in emails on machine
> 3. Virus sends emails to just about any email address it finds on that
> machine (yours, for instance, if you ever sent someone an email)
>
> Happy days, WW ;-}
>
> Kalkor
>
> -----Original Message-----
> From: owner-virus@lucifer.com [mailto:owner-virus@lucifer.com]On Behalf
> Of Walter Watts
> Sent: Monday, March 22, 2004 6:48 AM
> To: virus@lucifer.com
> Subject: Re:virus: Re: does it?
>
> I didn't send this.
>
> How do these virus kids and spammers and other assholes spoof your address
> like this?
>
> I NEVER open attachments, not from anybody, so it didn't affect me.
>
> I hope no one else was affected.
>
> Walter
>
> ----
> This message was posted by Walter Watts to the Virus 2004 board on Church
of
> Virus BBS.
>
<http://virus.lucifer.com/bbs/index.php?board=61;action=display;threadid=300
> 69>
> ---
> To unsubscribe from the Virus list go to
> <http://www.lucifer.com/cgi-bin/virus-l>
>
> ---
> To unsubscribe from the Virus list go to
<http://www.lucifer.com/cgi-bin/virus-l>
--
Walter Watts
Tulsa Network Solutions, Inc.
"Pursue the small utopias... nature, music, friendship, love"
--Kupferberg--
---
To unsubscribe from the Virus list go to
<http://www.lucifer.com/cgi-bin/virus-l>
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
|
|
|
|
DrSebby
Archon
Gender:
Posts: 456
Reputation: 8.07
Rate DrSebby
...Oh, you smell of lambs!
    
|
|
RE: virus: Re: does it?
« Reply #8 on: 2004-03-22 17:28:46 » |
|
....say there...sebby here. i received this email attachment with a virus
in it. is someone infected and auto sending? is it my system? i'll run a
virus scan in the meantime.
DrSebby.
"Courage...and shuffle the cards".
----Original Message Follows----
From: wlwatts@cox.net
Reply-To: virus@lucifer.com
To: virus@lucifer.com
Subject: virus: Re: does it?
Date: Mon, 22 Mar 2004 21:57:13 +0800
yours?
<< update_document.exe >>
_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8.
http://join.msn.com/?page=features/junkmail
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
"courage and shuffle the cards..."
|
|
|
|
|
Walter Watts
Archon
Gender:
Posts: 1571
Reputation: 8.61
Rate Walter Watts
Just when I thought I was out-they pull me back in
|
|
Re: virus: Re: does it?
« Reply #10 on: 2004-03-22 21:28:35 » |
|
DrSebby,
Was it wlwatts@cox.net or my old walwatts@tulsa.com (the old email address that i
abandoned after 9/11/2001 because of the following old interesting-I-think story).
Check out the date on this puppy--didn't take 'em long, did it?
-----------------------------
-------- Original Message --------
Subject: virus@lucifer.com list mail FILTERED BY TULSA.COM--HELP
Original Date: 13 Sep 2001 22:36:55 -0600
From: Walter Watts <wlwatts@cox.net>
Organization: "The Future's so Bright, I Gotta Wear Shades"
<snip>
At the moment, though, I've got something quite different to deal with
that I've got to decide a course of action.
It appears the domain that hosts my email account
http://www.tulsa.com
has suddenly decided to filter mail from virus@lucifer.com
I called this morning and talked to the wife of the owner of the domain,
who, when I told her of my lack of list mail for 36 hours from
virus@lucifer.com, replied:
"who would want email from such a domain"...."sounds like devil worship
to me"
When I tried to explain in an intelligent way that it was purposefully
named to repel people of low intelligence and mytho-literal bents, she
continued to ask more questions of the type of things discussed in the
forum.
I tried to explain, but eventually she asked "don't you people believe
in god"
Before the words "basically no" had escaped my lips, I heard the words
"I'll pray for you".
I continued to probe the whereabouts of my email, and several scenarios
were introduced by her, but all in a "we didn't change anything tone".
1) could be in virus box, maybe because of originating domain name
2) something else triggered a filter
and anyway, her words kept ringing "who would want mail from that domain
anyway"?
So now I'm faced with several choices: (after verifying with David
McFadzean that I'm still really subscribed)
BTW--this is not my ISP, only my email host.
1) blow 'em off and use either one of my @home email addresses or one of
my @walterwatts.com emails.
2) fight 'em--they host one really large website that I originally put
up (and with a little effort could probably get moved)
3) any ideas???
Walter
--------------------------------------
Dr Sebby wrote:
> ...whose addy was on it? the one i received had walwatts on it. did anyone
> get one with mine on it?
>
> DrSebby.
> "Courage...and shuffle the cards".
>
> ----Original Message Follows----
> From: "Walter Watts" <wlwatts@cox.net>
> Reply-To: virus@lucifer.com
> To: virus@lucifer.com
> Subject: Re:virus: Re: does it?
> Date: Mon, 22 Mar 2004 07:48:11 -0700
>
> I didn't send this.
>
> How do these virus kids and spammers and other assholes spoof your address
> like this?
>
> I NEVER open attachments, not from anybody, so it didn't affect me.
>
> I hope no one else was affected.
>
> Walter
>
> ----
> This message was posted by Walter Watts to the Virus 2004 board on Church of
> Virus BBS.
> <http://virus.lucifer.com/bbs/index.php?board=61;action=display;threadid=30069>
> ---
> To unsubscribe from the Virus list go to
> <http://www.lucifer.com/cgi-bin/virus-l>
>
> _________________________________________________________________
> Tired of spam? Get advanced junk mail protection with MSN 8.
> http://join.msn.com/?page=features/junkmail
>
> ---
> To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
--
Walter Watts
Tulsa Network Solutions, Inc.
"Pursue the small utopias... nature, music, friendship, love"
--Kupferberg--
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
Walter Watts
Tulsa Network Solutions, Inc.
No one gets to see the Wizard! Not nobody! Not no how!
|
|
|
simul
Adept
Gender:
Posts: 614
Reputation: 7.53
Rate simul
I am a lama.
|
|
Re: virus: Re: does it?
« Reply #11 on: 2004-03-23 08:01:50 » |
|
The virus may not be on your machine. As I said, it's trivial to spoof addresses. It doesn't require virus-writing skills.
---
To unsubscribe from the Virus list go to <http://www.lucifer.com/cgi-bin/virus-l>
|
First, read Bruce Sterling's "Distraction", and then read http://electionmethods.org.
|
|
|
|
Logged
