Post by: dakota on September 19, 2003, 08:46:57 AM
Post by: jepinto on September 19, 2003, 09:35:54 AM
I'm glad I use a Mac!
Post by: SnowWitch on September 20, 2003, 09:58:06 AM
emails...I recognized it as being a virus from something I'd recently read, but Norton didn't pick it up....I can't wait to get a new Rx for glasses so I can use the iBook more often....that 12" screen is a problem right now....trish
Post by: kelly on September 20, 2003, 11:08:57 AM
iBook (FireWire): How to View Video On an External Monitor or TV
http://docs.info.apple.com/article.html?artnum=88041
Post by: sandbox on September 20, 2003, 11:23:08 AM
http://securityresponse.symantec.com/avcen...2.gruel@mm.html
Post by: dakota on September 20, 2003, 12:16:31 PM
Post by: June Drabek on September 20, 2003, 03:30:37 PM
From: "Microsoft Corporation Technical Bulletin" <rdstmlfycowa@technet.microsoft.com>
Date: Thu Sep 18, 2003 10:55:06 PM America/Los_Angeles
To: "Customer" <customer.zebcoei@technet.microsoft.com>
Subject:
Attachments: There are 3 attachments
Post by: Diana on September 20, 2003, 07:48:37 PM
as ya'll are realizing, anything purporting to be a patch from Microsoft is bogus. I've had several of these also, and Norton, (and other av vendors) went several hours before getting a patch. Anyone who lets their machines auto-update should check to make sure that even if it updated on Wed/Thursday, you should go update again by hand...especially if you're on a PC.
Now for the interesting stuff..
This virus seems to be failing a small way in its spoofing abilities. As I said, I've gotten several copies, but it turns out that all of them have been from just two people so far. I've identified each person and each has been truly infected as confirmed by phone. Look in the headers for the Return Path: header. This virus doesn't seem to be using its own sending program since all the copies I've received so far have come through the actual ISP of the infected person's computer. If that e-mail in the Return Path header is someone you recognize or know, consider giving them a call.
One of the people I received from was someone I didn't know...but putting the e-mail from the Return Path: header in a search at Google returned an exact hit. A man in an important financial institution. I called and left a message. He returned my call and after a short introduction he freely admitted he was infected that morning ..and the timing was just minutes before I got the first instance of the virus from him. We were able to establish a "connection" to each other through common web pages, but we didn't know each other personally. He wisely disconnected his machine from the internet and called his system admin.
Maybe given this ability to track the infected machine, this virus won't last nearly as long as some others.
Everyone should thank God you have Macs.
see ya,
Post by: sandbox on September 20, 2003, 07:52:39 PM
Posted by timothy on Saturday September 20, @06:15PM
from the mmm-wriggling dept.
http://slashdot.org/
http://www.technewsworld.com/perl/story/31632.html
worm
http://securityresponse.symantec.com/avcen....swen.a@mm.html
tool
http://securityresponse.symantec.com/avcen...moval.tool.html
QUOTE
Still, even non-Windows users were affected by the worm's spread, as one TechNewsWorld reader -- a Mac user -- reported receiving more than 250 Swen e-mails in the last day.
MessageLabs chief technology officer Mark Sunner described the worm as highly complex and told TechNewsWorld that although it was first discovered September 14th, it was not seen as a priority, and the threat was not added to updated protection from leading antivirus vendors.
MessageLabs chief technology officer Mark Sunner described the worm as highly complex and told TechNewsWorld that although it was first discovered September 14th, it was not seen as a priority, and the threat was not added to updated protection from leading antivirus vendors.
QUOTE
"Initially, this went right under the nose of normal desktop antivirus," Sunner said, endorsing MessageLabs' intercept-and-scan approach over traditional antivirus methods that he claimed do not work. "It's almost inexcusable it went through those vendors."
QUOTE
"It's massively polymorphic," he said. "It randomizes file text, file name and subject with a high degree of polymorphism. Someone really thought about this."
Sunner likened the worm to the original Gibe worm, but said it was written in C++ and also used an SMTP engine, adding to the indications of a highly sophisticated author.
Sunner likened the worm to the original Gibe worm, but said it was written in C++ and also used an SMTP engine, adding to the indications of a highly sophisticated author.