Ping: Harrdy D...Again!

Terry Pulliam Burd said:

Harry - I replied to your email, but it bounced again. Looking at the email address of: harry.d@
and then there's something about a shaw and a canadian extension thingy.

Hi Terry

We've been a little overwhelmed with virus laden posts at 'harry .d' recently. This included
somebody forging our ISP address to post a legitimate sounding message regarding their server. It
contained the Beagle Virus. [All bow to Peter Norton's Service in thanks. They caught this].

I have just mailed you another addy. It's clean and doesn't do NGs. As the Air Canada guys tell you
after they screwed you around the block; "Sorry for the inconvenience. Your business is important to
us. Please come again." 🙁0

Harry

Quoted message said:

Terry "Squeaks" Pulliam Burd...making a stab at discrete AAC(F)BV66.0748.CA

"If the soup had been as hot as the claret, if the claret had been as old as the bird, and if the
bird's breasts had been as full as the waitress', it would have been a very good dinner."
Anonymous.

To reply, remove replace "shcox" with "cox"

Harry Demidavicius said:

Hi Terry

We've been a little overwhelmed with virus laden posts at 'harry .d' recently. This included
somebody forging our ISP address to post a legitimate sounding message regarding their server. It
contained the Beagle Virus. [All bow to Peter Norton's Service in thanks. They caught this].

Happy to see you, Harry. Sorry about the virus [censored], how annoying.

nancy

On Thu, 04 Mar 2004 05:40:21 GMT, Harry Demidavicius
<[email hidden]> arranged random neurons, so they looked like
this:

Quoted message said:

We've been a little overwhelmed with virus laden posts at 'harry .d' recently. This included
somebody forging our ISP address to post a legitimate sounding message regarding their server. It
contained the Beagle Virus. [All bow to Peter Norton's Service in thanks. They caught this].

I just got an email from my server this morning that said:

Hello user of Cox.net e-mail server,

Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail
account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your
computer safe, follow the instructions.

For more information see the attached file.

Attached file is protected with the password for security reasons. Password is 72340.

The Management, The Cox.net team cox.netcox.netOpen ↗

When I (stupidly) tried to open the zip file, Norton quarantined it before I could even get to the
password input. I sent an email to Cox's support querying the whole mess - anyone know anything
about this?

Quoted message said:

I have just mailed you another addy. It's clean and doesn't do NGs. As the Air Canada guys tell you
after they screwed you around the block; "Sorry for the inconvenience. Your business is important
to us. Please come again." 🙁0

On a flight back from New York City on American, as we landed at John Wayne in Orange County, the
pilot said, "Thank you for flying American and please refrain from smoking until well outside the
State of California."

Well, it's funny after a 6 hour flight!

Terry "Squeaks" Pulliam Burd AAC(F)BV66.0748.CA

"If the soup had been as hot as the claret, if the claret had been as old as the bird, and if the
bird's breasts had been as full as the waitress', it would have been a very good dinner." Anonymous.

To reply, remove replace "shcox" with "cox"

Terry Pulliam Burd said:

When I (stupidly) tried to open the zip file,

Why? Why would you do this? Why would you try to open an attachment you weren't expecting?

FYI, without the password virus scanners can't automatically scan the attachment. Password-
protecting the zip file is just another way to try to slip the virus past your defenses.

If you don't expect to get an attachment *NEVER* try to open them when they show up.

-Jeff B. yeff at erols dot com

Terry Pulliam Burd <[email hidden]> asked in message
"]news:[email hidden]...

Quoted message said:

Quoted message said:

Beagle Virus.

I just got an email from my server this morning that said:

Hello user of Cox.net e-mail server, [..]

[snip]

Quoted message said:

When I (stupidly) tried to open the zip file, Norton quarantined it before I could even get to the
password input. I sent an email to Cox's support querying the whole mess - anyone know anything
about this?

< "]http:[email hidden]

The W32.Beagle.K@mm worm:

o - Is a variant of W32.Beagle.J@mm that opens a backdoor on TCP port 2745 and uses its own SMTP
engine to spread through email. o - Sends the attacker the port on which the backdoor listens, as
well as the IP address. o - Attempts to spread through file-sharing networks, such as Kazaa and
iMesh, by dropping itself into the folders that contain "shar" in their names.

The email has the following characteristics:
= - From: Spoofed to appear as though it's coming from the one of the
following addresses at the recipient's domain: management administration staff noreply support
= - Attachment: A randomly named .exe file, stored inside a .zip file, or
a .pif file. The .zip file may be password-protected, though Symantec antivirus products will
detect these files.

----------------------------------------------------------------------------
----
Notes:
+ - Symantec Consumer products that support Worm Blocking functionality automatically detect this
threat as it attempts to spread.
+ - Virus definitions dated February 17, 2004 or later detect the extracted executable as
W32.Beagle.A@mm.
+ - There is no static MD5 hash value for this worm.
+ - Symantec Security Response has developed a removal tool to clean the infections of
W32.Beagle.K@mm. {Remaining notes and descriptions available on Symantec site.}

The removal tool is available and recommend it. <
"]http:[email hidden] [If the link
breaks, paste the entire thing into your nav-bar.]

As one poster said, "All bow to Peter Norton in thanks."

The Ranger

On Fri, 5 Mar 2004 10:29:00 -0800, "The Ranger"
<[email hidden]> arranged random neurons, so they looked like
this:

Quoted message said:

"]http:[email hidden]

The W32.Beagle.K@mm worm:

o - Is a variant of W32.Beagle.J@mm that opens a backdoor on TCP port 2745 and uses its own SMTP engine to spread through email. o - Sends the attacker the port on which the backdoor listens, as well as the IP address. o - Attempts to spread through file-sharing networks, such as Kazaa and iMesh, by dropping itself into the folders that contain "shar" in their names.

The email has the following characteristics:
= - From: Spoofed to appear as though it's coming from the one of the
following addresses at the recipient's domain: management administration staff noreply support
= - Attachment: A randomly named .exe file, stored inside a .zip file, or
a .pif file. The .zip file may be password-protected, though Symantec antivirus products will detect these files.

----------------------------------------------------------------------------

<snip>

Thanks. I ran Norton's program (twice) and it didn't detect the infection. Obviously, Norton knocked it out of the box before it got a chance to screw up my hard drive. Norton rules.

Terry "Squeaks" Pulliam Burd AAC(F)BV66.0748.CA

"If the soup had been as hot as the claret, if the claret had been as old as the bird, and if the bird's breasts had been as full as the waitress', it would have been a very good dinner." Anonymous.

To reply, remove replace "shcox" with "cox"

On Fri, 5 Mar 2004 01:30:50 -0500, Yeff <[email hidden]> arranged
random neurons, so they looked like this:

Quoted message said:

Terry Pulliam Burd said:

When I (stupidly) tried to open the zip file,

Why? Why would you do this? Why would you try to open an attachment you weren't
expecting?

FYI, without the password virus scanners can't automatically scan the
attachment. Password-protecting the zip file is just another way to try to slip
the virus past your defenses.

If you don't expect to get an attachment *NEVER* try to open them when
they show up.

Because I'm an idiot. I thought it was from my ISP and they sed:

Quoted message said:

Quoted message said:

Hello user of Cox.net e-mail server,

Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by a proxy-
relay trojan server. In order to keep your computer safe, follow the
instructions.

For more information see the attached file.

And I stupidly figured the email was legitimate. You'd think I'd know better than
that by now. I've been around Usenet and the Internet for, what, 12 - 14 years
now? Whatever, Norton caught it before I was able to wreak havoc on my computer.
According to cuhulain ("The Ranger"😉, it was a W32.Beagle.K@mm and I was damned
lucky that my Norton definitions were up to date. Thank you, Peter Norton.

Terry "Squeaks" Pulliam Burd AAC(F)BV66.0748.CA

"If the soup had been as hot as the claret, if the claret had been as old as the
bird, and if the bird's breasts had been as full as the waitress', it would have
been a very good dinner." Anonymous.

To reply, remove replace "shcox" with "cox"

Terry Pulliam Burd said:

Quoted message said:

When I (stupidly) tried to open the zip file, Norton quarantined it before I
could even get to the password input. I sent an email to Cox's support querying
the whole mess - anyone know anything about this?

I got the same stupid thing claiming to be from qwest or uswest (what qwest used
to be). I got rid of it ASAP. Unless I recognize you, your address and your
style, I get rid of it ASAP. blacksalt chewing over the penny per email idea in
the papers today.

kalanamak said:

Terry Pulliam Burd said:

When I (stupidly) tried to open the zip file, Norton
quarantined it before I could even get to the password
input. I sent an email to Cox's support querying the whole
mess - anyone know anything about this?

I got the same stupid thing claiming to be from qwest or
uswest (what qwest used to be). I got rid of it ASAP.
Unless I recognize you, your address and your style, I get
rid of it ASAP. blacksalt chewing over the penny per email
idea in the papers today.

I'd be absolutely amazed if any ISP would send anything in a
zip file, or an attachment for that matter. If you suspect
that it *may* be a valid mail (probably not) then check out
the headers or call the theoretical sender.

--
Steve

Men are from Earth. Women are from Earth. Deal with it.

Steve Calvin <[email hidden]> wrote in news:c2ck3k$1rkt1i$1@ID-
156610.news.uni-berlin.de:

Quoted message said:

kalanamak said:

Terry Pulliam Burd said:

When I (stupidly) tried to open the zip file, Norton
quarantined it before I could even get to the password
input. I sent an email to Cox's support querying the
whole mess - anyone know anything about this?

I got the same stupid thing claiming to be from qwest or
uswest (what qwest used to be). I got rid of it ASAP.
Unless I recognize you, your address and your style, I
get rid of it ASAP. blacksalt chewing over the penny per
email idea in the papers today.

I'd be absolutely amazed if any ISP would send anything in
a zip file, or an attachment for that matter. If you
suspect that it *may* be a valid mail (probably not) then
check out the headers or call the theoretical sender.

Most of these Viruses are written to take advantage of
people being generally lazy and only using the supplied mail
client i.e. Outlook or outlook express. If you use another
mail client, Bought or Freeware there is less chance of them
spreading due to the viruses not being able to get ahold of
a valid addressbook. Some of the freeware mail clients allow
you to put suspect mail into a spam folder...Suspect mail is
mail from people not in your address book. So using a
differing mail clients and anti virus protection should stop
the spread of viruses, by my way of thinking. I like
thunderbird...a freeware mail client from mozilla.

--
Once during Prohibition I was forced to live for days on
nothing but food and water.
--------
FIELDS, W. C.

kalanamak said:

I got the same stupid thing claiming to be from qwest or
uswest (what qwest used to be). I got rid of it ASAP.
Unless I recognize you, your address and your style, I get
rid of it ASAP. blacksalt chewing over the penny per email
idea in the papers today.

Camel's nose. Under the tent.

I doubt that many of us remember it, but a snail-mail letter
in the U.S. was once a penny, too.

gloria p

Yeff said:

On Thu, 04 Mar 2004 18:57:30 -0800, Terry Pulliam

Burd said:

When I (stupidly) tried to open the zip file,

Why? Why would you do this? Why would you try to open an
attachment you weren't expecting?

FYI, without the password virus scanners can't
automatically scan the attachment. Password-protecting the
zip file is just another way to try to slip the virus past
your defenses.

If you don't expect to get an attachment *NEVER* try to
open them when they show up.

-Jeff B. yeff at erols dot com

I do it to test my other computer...it's running bare except
that it has the free Grisoft anti virus software. I run
tests frequently, and when it has a problem, I just re-
format and start over. I guess you just have to like the
adventure! LOL *THIS* computer, though, is practically
bullet proof, but I still don't open unknown/unexpected
attachments.

BOB going out to check the ribs on the K3