Email Viruses

Paul G · 08-22-2002, 02:29 PM

Several people including myself are getting emails with viruses attached from webmaster@powwows.com.

I've checked the server and my machines and nothing infected. I have found that the source of the emails is an AOL user. The person(s) are spoofing my email address to send out these emails.

Please be aware of this issues.

Remember to always run a virus scan on incoming emails.

Thanks

**White Powwow Dancer** · 08-22-2002, 06:17 PM

Hi
Webmaster, What kind of worms?

Paul G · 08-22-2002, 06:19 PM

I think most of them are SirCam and Klez.

Mato Winyan · 08-22-2002, 10:13 PM

I am also getting emails from my one addy to another addy of mine. I also have gotten an email from a place that said they scanned it for someone and it was infected and they put a stop on it, but that it had originated from that address of mine that I had never sent out! This is starting to bother me. I also received one from a friend that I know that has two addy's but never sends to me from the one. I just sent it as a forward and said did you send this and here they hadn't. Is there ANYTHING we can do to stop this?

This is the latest one.

drutatsu@aol.com SCHEDLOG.zip (45114 bytes) DL Time (33600 bps): < 1 minute

Sheila Manning · 08-23-2002, 12:58 PM

I got bombed by that stupid Klez---I finally had to wipe out my computer and start over! Drag.

**NDNKIDZ** · 08-23-2002, 01:07 PM

We also got bombed @ home, had to reformat the whole hard drive.., they are also coming from chat rooms is what i was told:( :Yell

MrRuminator · 08-23-2002, 08:29 PM

Klez worm and it's variants disables one's antivirus programs, i.e. Norton, McAffee, etc. It grabs your email list as well as any message links on programs such as ICQ, IM and the like (probably name lists from this board too) and replicates itself. It then sends itself out as a phony message with your name as a sender or the name of someone on your lists tricking you into thinking it's a legit message. Then it disables all your links and exe files rendering your programs and your computer useless.
There is a fix available free from Norton, McAffee, et.al. , but once your links & exe files are gone they're gone.
Get the fix and load it pre-infection as it spoofs the worm into thinking you're already infected and it'll leave you alone.
The worm won't infect Mac's,Linux or Unix OS.

The up side to all this is that you finally get to clean all the junk off your hd. You also learn what Fdisk and Format c: is all about

All those in favor of immediate capital punishment to the perps of these worms, signify by the usual sign.

Paul G · 08-23-2002, 08:34 PM

These things are pretty nasty.

The traffic on my server has also increased because of it. There is one out there that uses the person's computer to try and attack web servers. The attack is for a Windows based server (PowWows.com is Linux). But the virus doesn't know and still tries to load it against my server. It is generating thousands of Page Not Found errors on the server!

In addition to Anti-Virus, everyone needs to have a Firewall like ZoneAlarm on their computer.

Mato Winyan · 08-24-2002, 12:29 AM

I went to do a virus scan today and got this (i have norton)

A required .DLL file was not found. N32USER.DLL

I was then told I would have to reload Norton???!!!!????

I have no clue what I am doing or what I should do... now I need a firewall??? I get overwhelmed!!!

:Cry

Paul G · 08-24-2002, 09:16 AM

The firewall is free and easy to use:

http://www.zonealarm.com

08-24-2002, 10:39 AM

2 other things here real quick from me

1.) anti-trojan software

www.anti-trojan.net

It not free, but reasonilblly priced, and darn good

2.) Anti-virus software

www.grisoft.com

You can get a freeby here which you can set to automatically update at a time you know you will be online. We run this with Norton's and AVP which are both pay services and the AVG(freeby)
catches more than the pay for ones do together.

MrRuminator · 08-24-2002, 11:15 AM

"Get the fix and load it pre-infection as it spoofs the worm into thinking you're already infected and it'll leave you alone. "

Actually, this is wrong. The worm itself generates a false email message in unpatched versions of Outlook and/or Outlook Express telling you to do this and once you've read the false message you're infected.

Go to Symantec or McAffee websites for correct info and keep your virus definitions current.

A firewall is only going to stop a hacker probe. Backdoor Trojans can hide for months before activating so you need to do a complete scan with current definitions before loading the free Zonealarm. Zonealarm will ask you if it should allow certain files/programs to run and frequently it will tell you that you've run them before or that you've visited a particular website so if you don't know exactly what the file refers to you may still be allowing a hacker access to your machine.

Sheila Manning · 08-24-2002, 11:47 AM

Great info....thanks!! :)

Mato Winyan · 08-24-2002, 12:43 PM

Quote:

Originally posted by Sheila Mannin

08-22-2002, 02:29 PM	#1 (permalink)
Paul G Webmaster Join Date: Jan 2000 Location: Lexington, SC Posts: 12,921 Blog Entries: 1	Email Viruses Several people including myself are getting emails with viruses attached from webmaster@powwows.com. I've checked the server and my machines and nothing infected. I have found that the source of the emails is an AOL user. The person(s) are spoofing my email address to send out these emails. Please be aware of this issues. Remember to always run a virus scan on incoming emails. Thanks

08-22-2002, 06:17 PM	#2 (permalink)
White Powwow Dancer Brakeman Join Date: Oct 2000 Location: ONIGAMIINSING (Little portage) Posts: 1,305	Hi Webmaster, What kind of worms? __________________ Asema Is Sacred Traditional Use, Not Misuse Wakan Tanka please have compassion on me. OK Niji we are running a train with red over yellow at this powwow.

08-22-2002, 10:13 PM	#4 (permalink)
Mato Winyan Dancing makes you smile Join Date: Mar 2000 Location: Indiana Posts: 5,477 Blog Entries: 4	I am also getting emails from my one addy to another addy of mine. I also have gotten an email from a place that said they scanned it for someone and it was infected and they put a stop on it, but that it had originated from that address of mine that I had never sent out! This is starting to bother me. I also received one from a friend that I know that has two addy's but never sends to me from the one. I just sent it as a forward and said did you send this and here they hadn't. Is there ANYTHING we can do to stop this? This is the latest one. drutatsu@aol.com SCHEDLOG.zip (45114 bytes) DL Time (33600 bps): < 1 minute __________________ "We see it as a desecration not only of a mountain but of our way of life. This is a genocidal issue to us. If they kill this mountain, they kill our way of life." ~Debra White Plume

08-23-2002, 12:58 PM	#5 (permalink)
Sheila Manning Pow Wow Visitor Join Date: Sep 2000 Location: Ada, Michigan Posts: 24	I got bombed by that stupid Klez---I finally had to wipe out my computer and start over! Drag. __________________ Mom to Rachel (97) Rebecca (99), p/t recording/sound engineer. p/t web based business

08-23-2002, 08:29 PM	#7 (permalink)
MrRuminator Tiny Tot Dancer Join Date: Feb 2000 Location: Near Kentucky, (I think) Posts: 50	Klez worm and it's variants disables one's antivirus programs, i.e. Norton, McAffee, etc. It grabs your email list as well as any message links on programs such as ICQ, IM and the like (probably name lists from this board too) and replicates itself. It then sends itself out as a phony message with your name as a sender or the name of someone on your lists tricking you into thinking it's a legit message. Then it disables all your links and exe files rendering your programs and your computer useless. There is a fix available free from Norton, McAffee, et.al. , but once your links & exe files are gone they're gone. Get the fix and load it pre-infection as it spoofs the worm into thinking you're already infected and it'll leave you alone. The worm won't infect Mac's,Linux or Unix OS. The up side to all this is that you finally get to clean all the junk off your hd. You also learn what Fdisk and Format c: is all about All those in favor of immediate capital punishment to the perps of these worms, signify by the usual sign. __________________ Cat & Dog ...Another white meat.

08-22-2002, 06:19 PM	#3 (permalink)
Paul G Webmaster Join Date: Jan 2000 Location: Lexington, SC Posts: 12,921 Blog Entries: 1	I think most of them are SirCam and Klez.

08-23-2002, 01:07 PM	#6 (permalink)
NDNKIDZ JIMMY HENDRIX ROYALTY Join Date: Jan 2002 Location: OKLAHOMA Posts: 1,144	We also got bombed @ home, had to reformat the whole hard drive.., they are also coming from chat rooms is what i was told:( :Yell

08-23-2002, 08:34 PM	#8 (permalink)
Paul G Webmaster Join Date: Jan 2000 Location: Lexington, SC Posts: 12,921 Blog Entries: 1	These things are pretty nasty. The traffic on my server has also increased because of it. There is one out there that uses the person's computer to try and attack web servers. The attack is for a Windows based server (PowWows.com is Linux). But the virus doesn't know and still tries to load it against my server. It is generating thousands of Page Not Found errors on the server! In addition to Anti-Virus, everyone needs to have a Firewall like ZoneAlarm on their computer.

08-24-2002, 12:29 AM	#9 (permalink)
Mato Winyan Dancing makes you smile Join Date: Mar 2000 Location: Indiana Posts: 5,477 Blog Entries: 4	I went to do a virus scan today and got this (i have norton) A required .DLL file was not found. N32USER.DLL I was then told I would have to reload Norton???!!!!???? I have no clue what I am doing or what I should do... now I need a firewall??? I get overwhelmed!!! :Cry __________________ "We see it as a desecration not only of a mountain but of our way of life. This is a genocidal issue to us. If they kill this mountain, they kill our way of life." ~Debra White Plume

08-24-2002, 09:16 AM	#10 (permalink)
Paul G Webmaster Join Date: Jan 2000 Location: Lexington, SC Posts: 12,921 Blog Entries: 1	The firewall is free and easy to use: http://www.zonealarm.com

08-24-2002, 10:39 AM	#11 (permalink)
Lonewolf Guest Posts: n/a	2 other things here real quick from me 1.) anti-trojan software www.anti-trojan.net It not free, but reasonilblly priced, and darn good 2.) Anti-virus software www.grisoft.com You can get a freeby here which you can set to automatically update at a time you know you will be online. We run this with Norton's and AVP which are both pay services and the AVG(freeby) catches more than the pay for ones do together.

08-24-2002, 11:15 AM	#12 (permalink)
MrRuminator Tiny Tot Dancer Join Date: Feb 2000 Location: Near Kentucky, (I think) Posts: 50	"Get the fix and load it pre-infection as it spoofs the worm into thinking you're already infected and it'll leave you alone. " Actually, this is wrong. The worm itself generates a false email message in unpatched versions of Outlook and/or Outlook Express telling you to do this and once you've read the false message you're infected. Go to Symantec or McAffee websites for correct info and keep your virus definitions current. A firewall is only going to stop a hacker probe. Backdoor Trojans can hide for months before activating so you need to do a complete scan with current definitions before loading the free Zonealarm. Zonealarm will ask you if it should allow certain files/programs to run and frequently it will tell you that you've run them before or that you've visited a particular website so if you don't know exactly what the file refers to you may still be allowing a hacker access to your machine. __________________ Cat & Dog ...Another white meat.

08-24-2002, 11:47 AM	#13 (permalink)
Sheila Manning Pow Wow Visitor Join Date: Sep 2000 Location: Ada, Michigan Posts: 24	Great info....thanks!! :) __________________ Mom to Rachel (97) Rebecca (99), p/t recording/sound engineer. p/t web based business