Alert! If Sorcha has your e mail!!!

Subject: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 02 Feb 02 - 01:18 PM

Just heard from several people that I "sent" them a virus. I have NOT deliberately sent any mail this morning so if you have recieved an e mail from me today (Feb.2) before 1:17 PM Mudcat time, DO NOT OPEN IT! It might say something about "software" in the subject box. I have scanned and appear to be clean for now. I don't know what is going on. Apologies if I have caused problems.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: wysiwyg
Date: 02 Feb 02 - 01:22 PM

Well, I didn;t get it!

~S~

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 02 Feb 02 - 01:25 PM

Veddy weeiirrrdd. So far, 3 notifications that I was infectious. Seems to me it should have gotten everybody. Never heard of a selective virus before.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Amos
Date: 02 Feb 02 - 01:53 PM

Sorch:

Depends on the script -- it can draw names off your recently sent mail (in a Windows environment) as easily as your whole mail list).

Whyncha getta Mac? (Ok, ok, ok!!! LOL!!)

A

Subject: RE: Alert! If Sorcha has your e mail!!!
From: InOBU
Date: 02 Feb 02 - 03:08 PM

Hiya Sork... I think you have sent me email in the past... didn't get anything with a virus recently from ya... Cheers, Check out my post last week about the destructive non-virus hoax... that might be what is up. Cheers Larry

Subject: RE: Alert! If Sorcha has your e mail!!!
From: catspaw49
Date: 02 Feb 02 - 03:17 PM

Ain't got one yet Sorch!! We communicate a good bit so I wonder how the virus picks and chooses? What virus is it BTW??

Spaw

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 02 Feb 02 - 03:21 PM

I just got this back from the guy who infected me...

W32.Magistr.39921@mm Never heard of it.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: GUEST,MCP
Date: 02 Feb 02 - 03:27 PM

This is a link to Symantec's info on it w32.magistr.39921

Mick

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Mark Cohen
Date: 02 Feb 02 - 03:29 PM

Sorch, here's a Symantec page on what is probably a related virus...I didn't have time to search further but this may point you in the right direction.
magistr virus

Aloha,
Mark

Subject: RE: Alert! If Sorcha has your e mail!!!
From: kendall
Date: 02 Feb 02 - 04:33 PM

My Norton anti virus picks up an infection before I get to see it. It sends me a notice that a certain e mail is infected. However, that "party pictures" thing got by it. Lucky a friend warned me about it before I got it. This version of Norton also scans all my outgoing e mail for infections too.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Tweed
Date: 02 Feb 02 - 04:36 PM

What version do you have Kendall? Mines about three years old and could use an upgrade real soon.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Mark Cohen
Date: 02 Feb 02 - 09:05 PM

Tweed, more important than having the latest NAV version is keeping your virus definitions up to date...your anti-virus program can't detect a virus it doesn't know about. They recommend updating every two weeks, but I update mine weekly, and now that I have RoadRunner I may do it even more often.

Aloha,
Mark

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Devilmaster
Date: 02 Feb 02 - 11:41 PM

Just as a little help, Trend Micro, makers of PC-illin, has a free online virus scanner called housecall. Plus has info on all viruses and ways to delete, if housecall cannot get rid of it.

The webpage is here.

Hope it helps

Steve

Subject: RE: Alert! If Sorcha has your e mail!!!
From: catspaw49
Date: 05 Feb 02 - 11:50 AM

Hey Sorch! Just got it from you. Norton caught it and did it's thing, but it is the same one you listed above. Go to the Symantec site, or one of them, and do the fix 'cause this one still has you.

Sorry Darlin'

Spaw

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 05 Feb 02 - 11:54 AM

Dammit!!

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 05 Feb 02 - 01:15 PM

I have now done EVERYTHING--- that I was told to do at SYMANTEC--scanned, disabled restore, scanned in safe mode, re boot, re scanned all program files, scanned e mail, and I can't find a damned thing that says it is infected. Is it possible that some of you are just now recieving mail that was sent when I was infected???? Losing my (only)brain cell here!

Subject: RE: Alert! If Sorcha has your e mail!!!
From: GUEST
Date: 05 Feb 02 - 01:19 PM

ANY ONE WHO DOES NOT KEEP UP-TO-DATE ANTI-VIRUS SOFTWARE OPERATING ON EVERY PIECE OF E-MAIL THAT COMES IN OR OUT OF THEIR COMPUTER IS COMPLETE MORON!

P.S. Don't bother telling me that I was shouting. I did it on purpose.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 05 Feb 02 - 01:30 PM

I DO YOU STUPID FUCK It's just that I am not AllKnowing like a Guest. I make mistakes once in a while, OK?

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Hollowfox
Date: 05 Feb 02 - 02:09 PM

'Sallright, darlin', at least you have the class to let us know if there's a potential problem.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: GUEST
Date: 05 Feb 02 - 02:40 PM

OOH Sorcha,

It looks like you took a might big bite of troll bait there.

LOL

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Dave Wynn
Date: 05 Feb 02 - 07:21 PM

Thanks Sorcha. I use McAfee and just noticed (after reading this thread) that my email scan was disabled. I have enabled all now thanks to you.

Much appreciated.

Spot (who should know better coz it's my job)

Subject: RE: Alert! If Sorcha has your e mail!!!
From: katlaughing
Date: 05 Feb 02 - 07:33 PM

Thanks, Sorcha. Just did a Norton and found the magistr and badtrans, as well as one called midgets. I got rid of them. The only problem I have now is the update won't work with Win95. Looks like we might have spend some to do 98 and get updated. I appreciate all of your efforts to keep us informed and remember...someone had it before you!*bg*

kat

Subject: RE: Alert! If Sorcha has your e mail!!!
From: wysiwyg
Date: 05 Feb 02 - 07:52 PM

I am wondering if McAfee kicked it out before I got it, via Hotmail-- because my Norton has not blinked and I am protected against these. Anyone else get it through Hotmail?

~S~

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Beer
Date: 05 Feb 02 - 08:05 PM

You wrote to me some time ago in response to a question I had asked,all is well and no virus.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: katlaughing
Date: 05 Feb 02 - 09:22 PM

Ah, I am all set, but it wasn't one called "midgets" it was actually the Hybris worm. Thanks, again.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Louie Roy
Date: 05 Feb 02 - 10:45 PM

Chin up Sorcha we are all very proud of you for the way you handled this situation.You wasted no time letting everyone on mudcat know that there was a vicious virus around and you had been infected.When you get a virus you have no control other than trying to keep your virus protection updated and sometimes that even fails and if that phony know it all Guest would indentify himself and quit hiding behind the call letters G.U.E.S.T.I'm sure there would be a great many of us who would be glad to take a poke at him and we damn sure wouldn't hide our idenity.Louie Roy

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 05 Feb 02 - 10:50 PM

Yes, all, I bit troll bait. I apologize for that. I shouldn't have, I know that. I have been very, very silent during all the crap lately, and intend to keep doing so. I had a very bad day and just lost it momentarily. Tomorrow will be better. I spent all day at this F***ing computer trying to make sure my computer no longer has VD.....I hope it worked.

I called the "geek"....maybe he'll call me back tomorrow and come check to make sure.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Amos
Date: 05 Feb 02 - 10:56 PM

SOrcha:

Chin up, ducky -- at least you bit the bastard among friends!!! :>)

A

Subject: RE: Alert! If Sorcha has your e mail!!!
From: wysiwyg
Date: 05 Feb 02 - 11:09 PM

Sorks, no one knows better than I how outrageous it is to be baited while in full virus-fix storm. Don't be mad at yourself for biting-- you done good. The rest... you know who your friends are. The rest is a house of mirrors.

~Susan

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 05 Feb 02 - 11:15 PM

e mail on its way, ~S~,,,,Thanks, friends. When I bite ass, I bite deep.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: catspaw49
Date: 06 Feb 02 - 12:09 AM

BTW Sorch, the one I got was same day time. Marked about the same time I posted above.

Spaw

Subject: RE: Alert! If Sorcha has your e mail!!!
From: technission
Date: 06 Feb 02 - 12:06 PM

I hope I don't cause grief pushing this thread back up to the top! I just wanted to post the following information that came from my employer, in case it provides any additional insight that is of help. Way down close to end there are several websites for information; may be the same ones mentioned upthread. If you copy URLs to your browser don't forget to remove > from start of each bodycopy line.

Because of the antisocial nature of this threat, and the public nature of access to these forums, I felt it necessary to remove all references to my employer using [XXX] which also invalidates some proprietary websites referenced, but the public ones I left in are good addresses.

Good luck guys! I feel your pain, but my Mac is immune to this one...not gloating, really. It's all I can afford, old and slow from university surplussing. But I did win a "parts" CPU from them for $5.89 and took out of it 64M of RAM and a 2G hard drive to add to old-and-slow, *now* I'm gloating. I remember when a 40 *meg* drive was more than enough, can't wait to re-read this in 3 years...

hasta, michael 8>)#

>X-From_: owner-alldepts@ [XXX] Tue Feb 5 12:11 CST 2002 >X-Priority: 3 (Normal) >Importance: Normal >X-Virus-Scanned: by AMaViS snapshot-20010714 >Date: Tue, 5 Feb 2002 11:23:18 -0600 >Reply-To: [XXX] >Sender: ALLDEPTS -- [ XXX ] University Departments > From: [ XXX ] >Organization: [ XXX ] University Information Technology >Subject: Virus Alert: "Klez" Virus and E-mail Warnings >Comments: To: ALLDEPTS@ [ XXX ] >To: ALLDEPTS@ [ XXX ] > >Hi all, > >An e-mail virus is going around by the name of "Klez" which also drops >a new virus variant called "Elkern" on infected systems. Please read >on, because this message addresses the "VIRUS IN YOUR MAIL" warnings >that many [ XXX ] folks have received recently. > >Information on these viruses is very preliminary at this stage, but I >need to distribute this advance warning because of some particularly >antisocial aspects of this virus combo. Please forgive any errors in >the facts that result from this early assessment. > >The "KLEZ" and "ELKERN" Worms >----------------------------- > >Virus names: KLEZ > W32/Klez.gen@MM > Klaz > TROJ_KLEZ.C > Klez.E > Klez.G > Stemdil > > ELKERN > W95/Elkern.cav > W32.ElKern.3326 > >Systems Affected: PCs with any version of Windows. Macs and UNIX >systems are not affected. > >Methods of Propagation: > >Klez (variants "E" and "G") is an e-mail virus that uses a very >sophisticated algorithm to generate fake e-mail messages with >similarly fake return addresses. If you receive a message from Klez, >most likely the address is in the From: field is not the person who >sent it. Klez generates fake holiday greetings for most major >holidays, it grabs subject lines from existing e-mail, and it can >compose sentences from a large combination set of sentence fragments, >including sentences that sound like different virus warnings. Klez >infects individual executable files, and scans your network disks and >any open Windows file shares it can find and drops a copy of itself >with a double-extension to trick the user into opening it >("blahblah.txt.EXE"). > >Elkern is a new virus variant ("B") that is installed by Klez. Elkern >is a more typical file-infection virus with the antisocial tendency to >overwrite files with zeros, leaving the file size intact. This can >rapidly render the operating system unusable or destroy applications >and data. Like Klez, it scans network drives and open file shares and >attempts to install itself on poorly secured systems. Due to bugs in >its programming, Elkern will instantly crash any Windows 95 or NT >system, and possibly Windows ME or XP systems. It will run correctly >(if it can be called "correctly") on Windows 98 and 2000 systems. > >Risk to [ XXX] Campus: Moderately High. The bad news is that Klez and >Elkern exploit almost every trick in the book to try and propagate >themselves, and the fake e-mail that Klez generates looks very >realistic. The good news: our latest version of VirusScan with the >most recent virus signatures will detect and stop this virus. > > >BAD VIRUS WARNINGS >------------------ > >You may receive a message from "postmaster" with the warning: > >Subject: VIRUS IN YOUR MAIL > > V I R U S A L E R T > Our viruschecker found the > W32/Klez.gen@MM > virus(es) in your email to the following recipient(s). > >In all likelihood, this warning is in error. Because Klez creates fake >(but intelligently chosen) "From" addresses on its messages, chances >are that the e-mail virus scanner sent the warning to the wrong person >-- that is, YOU. In fact, there is no way to figure out who really >sent the virus-infected e-mail purely by examining the infected >e-mail. > >WHAT YOU SHOULD DO >------------------ > >If you receive the virus warning and you use a Mac or UNIX system for >your e-mail, just ignore the warning and throw it away. It does not >apply to you. > >If you receive the warning and you use a PC with Windows, the warning >is most likely invalid, but infection remains a possibility. Make sure >you have a current anti-virus scanner installed on your PC. If you're >using [ XXX ] 's McAfee VirusScan product, make sure you are currently >updated with the latest virus signatures: > >http://www. [ XXX ] > >The current (version 4184) signatures can detect and remove the latest >variants of both Klez and Elkern. If you don't have McAfee VirusScan >installed, now is the time to install it. Use the links at > >http:// [ XXX ] > >to obtain and install it, then update with the latest signatures. > >If you use a centrally-managed PC with Windows NT, 2000 or XP, your >system administrator may apply updates for you automatically. Contact >your local support team if you have any questions about that >procedure. > >And as always, never open an attachment whose validity has not been >confirmed with the original sender in plain, specific language. Never >open an attachment with a .EXE extension. > >If you think you are infected, contact IT staff immediately for >assistance at http:// [ XXX ] > >MORE INFO >--------- > >Virus Info and Software Updates: > >http:// [ XXX ] > >Klez Links: > >McAfee/NAI: http://vil.nai.com/vil/content/v_99237.htm >Datafellows: http://www.datafellows.com/v-descs/klez.shtml > >Elkern Links: > >McAfee/NAI: http://vil.nai.com/vil/content/v_99238.htm >Datafellows: http://www.F-Secure.com/v-descs/elkern.shtml >Symantec: >http://securityresponse.symantec.com/avcenter/venc/data/w32.elkern.3587. >html > >-- > >As in the past, please do not distribute this message outside the [ XXX ] >community. Also, please do not distribute this message after March 15, >2002. If there is relevant, new information available, it will be >posted in an updated message to ALLDEPTS.

[Yeah, well I feel OK about sending it because I copied to word-processor, removed all references and addresses to the university itself, send through non-university email and don't see any way this could disadvantage them after those precautions.....and to anyone who might be able to backdoor through a residual IP address: the countermeasures do need occasional testing, so - go ahead, make their day!] [[ one of my favorite aphorisms: "Just because you're paranoid doesn't mean they're not out to get you !! " ]]

>This message is preserved, fresh-frozen for eternity at > >https://www.[ XXX] >-- >[ XXX sigblock] --

Subject: RE: Alert! If Sorcha has your e mail!!!
From: technission
Date: 06 Feb 02 - 12:18 PM

Yeccchh, because of the way I copied the virus info thing the formatting was lost and it's really densely packed and hard to read. Well, you wouldn't anyway unless you really needed it. Salient points: 1.It (virus) copies To and From addresses from others on *your* computer, if I understood, and there is *no* way of telling whose mail delivered it to you. 2.*Don't open* attachments that are .exe files! 3.*Don't open* email that has .exe anywhere in it's subject

And to all you pizza-face pre-adolescent hackers out there inventing these things : What you are doing has no redeeming value and is, in fact, terrorism. Some day you will lose data you value, that's elementary karma that you can't escape. Think about it.

terminate

Subject: RE: Alert! If Sorcha has your e mail!!!
From: JohnInKansas
Date: 06 Feb 02 - 03:47 PM

If I read technission at 12:06pm correctly, the paragraphs:

You may receive a message from "postmaster" with the warning:
Subject: VIRUS IN YOUR MAIL
V I R U S A L E R T Our viruschecker found the W32/Klez.gen@MM virus(es) in your email to the following recipient(s).

In all likelihood, this warning is in error. Because Klez creates fake (but intelligently chosen) "From" addresses on its messages, chances are that the e-mail virus scanner sent the warning to the wrong person -- that is, YOU. In fact, there is no way to figure out who really sent the virus-infected e-mail purely by examining the infected e-mail.

... you could receive a "webmaster" or recipient's warning that you sent an email containing a virus when in fact the virus on someone else's machine took your "name" (from the infected machine's address book?)and used it as "sender name" to send itself to some other person.

Well... falsifying return addys ain't nothin' new, except that this is an example of a specific virus that may do it.

Of course, if their is the slightest possibility of passing something on, we all need to do the maintenance - keep a good virus scan program in place, use it often, and update sig files frequently.

John

Subject: RE: Alert! If Sorcha has your e mail!!!
From: catspaw49
Date: 06 Feb 02 - 07:12 PM

Hey Sorch.....Just got another from you. Norton repaired it and I sent it back so you could see it......Time was basically current. Sorry........

Spaw

Subject: RE: Alert! If Sorcha has your e mail!!!
From: 53
Date: 06 Feb 02 - 09:47 PM

Good to talk again Sorcha, just don't pay any atention to that asswhole, and he'll just smell away.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: heric
Date: 06 Feb 02 - 10:32 PM

Thanks, Devilmaster. I don't want to sound too dim, but at http://www.antivirus.com/free_tools/, it says: "Scan Your PC, Free . . . There's nothing to install and nothing to update." So, I clicked on it. Now why I am sitting here watching the following screen forever: "Please wait while the update files download."

Subject: RE: Alert! If Sorcha has your e mail!!!
From: GUEST
Date: 07 Feb 02 - 12:10 AM

Thanks, Devilmeister! I had a worm. (Named "worm," even.

Dan

Subject: RE: Alert! If Sorcha has your e mail!!!
From: 53
Date: 07 Feb 02 - 10:53 PM

need some more wheat pennies.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Sorcha
Date: 08 Feb 02 - 08:12 PM

Hello all; just came down to the cop shop to check for messages. My puter is in ER, don't know when surgery is scheduled.......just don't open ANY mail from me with "a weirdness" in the subject line.......what a mess. I can't stay here too long, but I'll check in every couple days until the computer is fixed.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: 53
Date: 08 Feb 02 - 08:14 PM

Thanks for the info.

Subject: RE: Alert! If Sorcha has your e mail!!!
From: katlaughing
Date: 08 Feb 02 - 11:28 PM

Sorry, Sorcha, I know I posted about the ER trip in a thread, thought it was this one. Hope you get it back, all clear and ready to hunt up some more goodies!

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Amergin
Date: 08 Feb 02 - 11:34 PM

Well....Sorry to hear about your troubles, Sorcha, my friend....I hope you get your pc back to you safe and sound....in the meantime I have this for you:

(((((((((((((((((((((((((((((SORCHA)))))))))))))))))))))))

Love ya!

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Devilmaster
Date: 09 Feb 02 - 12:28 AM

Dan, what kind of connection are you at? it will take a couple minutes if your using dial-up.

If it does hang, I don't know what to tell ya but write to them.... the task bar fills up while the updates load, then a new page will load after.

Hope it helps, mate.
Steve

Subject: RE: Alert! If Sorcha has your e mail!!!
From: Devilmaster
Date: 09 Feb 02 - 12:32 AM

For those who might have problems with the free housecall software, as mentioned above, here is the faq for it.

How to use HouseCall:

If this is your first time using HouseCall, expect to wait several minutes while the scanner loads. This time will vary depending on your modem speed and will be shorter the next time you visit. When HouseCall finishes loading in the window above, you will see a list of the disk drives on your computer.
Click on My Computer.
Click the SCAN button to start.

Troubleshooting:
To use HouseCall, you will need either Microsoft Internet Explorer (version 4.0 or above) or Netscape Navigator (version 3.01 or above). If HouseCall does not work correctly on your PC for any reason, please download a free 30-day trial version of PC-cillin, Trend Micro's antivirus solution for home PC users.
Having trouble? Check the Frequently Asked Questions page for more troubleshooting tips.
If HouseCall finds a virus:

If HouseCall finds a virus on your PC, it means that your current antivirus solution is not working properly. When HouseCall finds a virus, it will list the name of the virus as well as the name of the infected file. Click on the virus name to learn more about it. Click on the "Clean" button to remove the virus. Certain viruses, such as Trojans, scripts, overwriting viruses, and joke programs which are identified as "uncleanable", should simply be deleted.
To keep your PC virus-free by blocking viruses in real time, download a free 30-day trial version of PC-cillin, Trend Micro's antivirus solution for home PC users.
HouseCall can only detect viruses after they have infected your PC. PC-cillin provides complete protection by blocking viruses at every entry point before they can get into your PC and delete your files or spread to everyone in your address book.

Steve