frEEk
Administrator
ummm... yeah
Posts: 9660
|
posted May 30, 2002 12:40 PM
all members please read: virus
in the last few days we have received 3 infected emails at webmaster@bikeland.org, and all appear to be from members. certainly the emails were not sent out intentionally, the virus is launching them itself. the virus in all 3 cases is called W32/Klez.h@MM
for anyone who is unsure as to whether they are infected, please scan ur system. if u own virus scanning software, make sure ur DAT files are updated. if u don't, u can go to http://www.pc-cillin.comand use their free (u do not have to give them ur email/regster when they ask) web based scan.
and for goodness' sake people, dont open attachments u'r not sure about! these infected emails are always REAL EASY to spot. if there are any exxecutable attachements to an email (.exe, .bat, etc) dont open them. if u have an executable sent to u, even if it's only one item in a list of aparently benign attachments (images, html files etc), confirm with the sender that they meant to send it.
thx for ur collective attention 
   
|
TeamSpeed
Expert Class
Posts: 449
|
posted May 30, 2002 02:14 PM
This latest Klez variant does not require you to open an attachment. It uses some holes in the Outlook mime processing to kick itself off. I think you only have to read the message, I believe. I could be wrong though, I didn't write this virus... 
|
redelk
Moderator
Please... speak to the hand.
Posts: 3212
|
posted May 30, 2002 04:23 PM
I wonder....
It looks like that the majority of the self executing viruses are designed to get around various protective aspects of Microsoft's Outlook Express. It seems that other e-mail software isn't affected in the same way.
I get at least 2~4 of the viruses every day from customers and even from some state agencies. All of them are some kind of executable file (exe, bat and so on). Needless to say, they all go straight into the trash and is purged from the system later in the day.
I got hit by the Melissa virus... ONCE! I was expecting an attachment from a bussiness associate and without even looking at the title (which I would have known was a virus), I executed it. Lost every non-zipped bitmap I had on the system. I was using Netscape's e-mail at the time.
Here's what worries me... a while back I switched from Netscape 4.7 e-mail to Eurdora 5.1 (Paid Mode). I did this when I brought the new systems online and switched to from Netscape 4.7 to IE 6.0.26 as my browser. Since being able to access old e-mails is very important, Outlook Express would not work for me.
Anyway, in the file manager (windows explorer or what ever you want to call it), in the "Eudora" folder is another folder named "Attach". In this folder is all the attachments that come with the e-mails I recieve. This is not a "temp" folder and has all the bitmap and EPS/AI attachments I've ever received. Including all the ones I got with the old e-mails I've transfered from Netscape.
What's weird is that there isn't a single executable attachment in this folder. Does anyone know why that is? When ever I open that folder, all the icons for the bitmaps and EPS files are the actual image that was attached to the e-mail. I figure that this is due to the fact that I have Adobe Illustrator and Photoshop.
The thing is, if it's not one of these types of files, it ain't in there. A lot of these viruses try to pass themselves off as some kind of Microsoft Word document. Since my version of Word is so old (pre Win95 MS Office), I'm guessing that it doesn't recognize the attachment as a Word document. Beats me.
All my e-mails are not saved on my ISP mail server, but are downloaded onto my system as soon as it checks my e-mail (every 60 seconds). Does anyone have any opinions on why this is?
____________
There are only three sports: bullfighting, motor racing, and mountaineering; all the rest are merely games.
-Ernest Hemingway
|
12RPilot
Pro
Posts: 1094
|
posted May 30, 2002 04:51 PM
That damn Klez is really making the rounds. I got it from my aunt about 3 weeks ago. Guess it's time to scan the system again.
____________
If you aren't an AMA member, you're part of the problem.
NESBA #209
http://www.bikepics.com/members/12rpilot/04zx10r/
 
|
TeamSpeed
Expert Class
Posts: 449
|
posted May 30, 2002 06:02 PM
Viruses do not have to be in executables. They can come in many different types of Microsoft command files (batch scripts, exe's, and many other macro type files). There are other ways for these to propogate too. If you have message preview turned on in Outlook and Outlook express, the virus can spread as soon as you go to that message. The safest way is to turn off the preview pane, this way your virus checker can catch the files/viruses before you accidentally execute them via the preview.
|
frEEk
Administrator
ummm... yeah
Posts: 9660
|
posted May 30, 2002 06:47 PM
previews/auto-opening attachments is the stupidest thing anyone writing an email client could build. sure its a nice enough idea in a way, but not realistic at all, as is proven over and over again with cases like these. I'v been using both Mozilla (netscape) mail and outlook express, and fortunately neither one tries to do this. besides, if i even try to save an attachment from an email in windows, mcafee kicks in & blocks the action. anti-virus software is cheap insurance folks! the copy i run is the one i got with the computer like...3 or 4 years ago. still get free updates.
|
redelk
Moderator
Please... speak to the hand.
Posts: 3212
|
posted May 30, 2002 06:57 PM
 Edited By: redelk on 30 May 2002 20:26
The plot thickens....
After running PC-cillin, there were 31 viruses lurking about my system. 29 of them were in the previously mentioned "Attach" folder under Eudora and the other 2 were in another Eudora folder. Over 70% of them were some variant of the W32/Klez.h@MM worm virus.
PC-cillin cleaned the non-worm viruses and I had it delete all of them. I then emptied my Norton trash and protected folders. After that, I renewed the company's McAfee Clinic subscription and am currently scanning my system again.
One thing I've now learned is that by just deleting the e-mail and empting the trash folder DOES NOT necessarily get rid of the virus. I've also learned that W2K Professional has zillions of folders and cache files that those boggers, if executed, cuold hide from the average computer Joe.
This just brings up more questions.
1. Why didn't any of the viruses execute themselves?
2. Was it because I didn't open any of the attachments?
3. I have 4 drives. Two are mirrored by hardware on the motherboard and the other two are mirrored by software. When the infected system is set up with a RAID, does a protection software remove the virus from the mirrored drive as well?
4. My system is also networked to my art director's system via a basic D-Link 910 (DSS-5+ hub & DFE-530TX+ cards) 10/100 Ethernet. Since he does NO internet activity, does not access the Eudora folder on my system and the odds are these virus did NOT execute... what are the chances of them being on his system?
EEK! McAfee found FOUR MORE VIRUSES (out of the 157,547 files on my system) that PC-cillin MISSED! They were also in the "Attach" folder as RBO files (aka - W32/Magistr.b@MM virus)
5. Does this mean that PC-cillin will recognize the W32/Klez.h@MM virus, but not the W32/Magistr.b@MM?
6. Since it appears than no one in my address book has received one of these viruses from me, does that mean they have not executed?
According to McAfee, in the past 7 days and of the 105,351 U.S. computers scanned (and participating in their automatic survey), here's how the top 10 viruses ranked...
Virus / # of infected systems / % of total
1. W32/Klez.h@MM / 14,932 / 14.17
2. JS/NoClose / 9,911 / 9.41
3. JS/IEStart.gen.c / 5,488 / 5.21
4. W32/Klez.eml / 2,226 / 2.11
5. W32/Magistr.b@MM / 1,811 / 1.72
6. Downloader-W / 1,549 / 1.47
7. BrowseEvt / 1,474 / 1.40
8. JS/Seeker.gen.e / 1,390 / 1.32
9. VBS/LoveLetter@MM / 1,353 / 1.28
10.W95/Elkern.cav.c / 1,329 / 1.26
These numbers have already changed in the past 5 minutes sine I've posted them!
____________
There are only three sports: bullfighting, motor racing, and mountaineering; all the rest are merely games.
-Ernest Hemingway
|
TeamSpeed
Expert Class
Posts: 449
|
posted May 30, 2002 07:44 PM
Edited By: TeamSpeed on 30 May 2002 20:55
Interesting fact, alot of viruses hide themselves in your recycle bin. Alot of people never clean out the recycle bin until they need to recover the space. Also, alot of virus checkers (until recently) never checked the recycle bin because this is where you would be putting infected files as you detected them.
You may not know if the viruses executed, alot of the more recent ones have random actions, and defered payloads (do detrimental actions on some date or in X days). The latest Klez worm has its own emailing engine, and sends emails from you to others, but changes the from line to make the emails look like they came from other individuals. This is to help hide the source of the infected machine. This one, or one of the other variants, also has like 30+ different subject lines so the virus checkers have a hard time keeping up with all the possibilities.
Before anyone asks, no, I do not write viruses, but I have pulled infected batch files into editors to see what exactly the code is doing. I infected one of my machines one time by opening a file, and stopped everything on my machine until I could determine the effect. I did not have virus checking software, so I had to manually back out the effects of the executed virus before I could install the virus checker. This particular virus changed the system registry to run itself whenever I would kick ANYTHING off. I could not reboot the machine or run anything until I had removed all virus files I could find, and manually clean out the registry so I could finally install the software.
I am pretty anal about my systems at home. I have just installed a wireless network utilizing my DSL connection, and have to protect my computers. I also plan to hook my Xbox to this same network using the Linksys WET11 access point, so viruses within my network could do alot of damage. I WEP enable my connections, installed firewalls on all computers, virus software on all computers, etc. It is almost a full-time job just keeping my systems locked down.
If any of you would like to know how safe your connection to the internet is, try going to this site http://grc.com/default.htm. This site offers free software to check your ports and whether you are open to outside attacks, really a great eye opener to what could happen to your computer...
|
daveindaytona
Pro
Posts: 1696
|
posted May 30, 2002 08:16 PM
Red, if you want to look at what those viruses do you can look here http://www.sarc.com/avcenter/vinfodb.html?prodid=nav2002
You should only see files in the eudora\attach directory that were sent to you. You can also change the attachment directory in the options if you'd like.
You can have all kinds of infected files sent to you without being "infected". In a lot of cases they need to have an event to trigger the payload and you are right a lot of them get launched by virus friendly programs like Outlook. You also may not be able to tell one has launched by any means other than finding it with a virus program.
The passing of viruses through system shares are common too so I would be concerned of the possibility that they could pass from your system to the art director's system.
I prefer a virus program that automatically schedules updates, system scans, and has an active scan in incoming email files. It's hard to get a problem with it running that way.
Oh, don't send me any files, OK ?
Compute Safe,
Dave
____________
DaytonaSportbikes Forum
|
redelk
Moderator
Please... speak to the hand.
Posts: 3212
|
posted May 30, 2002 08:44 PM
Dave...
Venom wanted me to send this to you, so you got mail!
BAHAHAHAHAHAHA! (just kiddin')
____________
There are only three sports: bullfighting, motor racing, and mountaineering; all the rest are merely games.
-Ernest Hemingway
|
DaveInDaytona
Pro
Posts: 1696
|
posted June 01, 2002 03:53 AM
Not to worry Red, after all that debate they deleted that thread. That will be my last post there.
Dave
____________
DaytonaSportbikes Forum
|
zx12zx11
Expert Class
Posts: 471
|
posted June 02, 2002 07:44 AM
Edited By: fish_ANTLERS on 2 Jun 2002 10:27
Ya could also go to LINK REMOVED and get any antivirus software that you wish for free, but that would be sharing files or stealing.
|
fish_ANTLERS
Administrator
The Truth is Out There
Posts: 21896
|
posted June 02, 2002 07:59 AM
of course only a FOOL would download cracked virus software since EVERYONE KNOWS THAT CRACKED ANTIVIRUS SOFTWARE CAN LEAVE YOUR SYSTEM VULNERABLE TO ATTACK.
DONT BE CHEAP> GO BUY SOME ANTIVIRUS SOFTWARE.
Downloading MP3s is different than cracked security software..
|
zx12zx11
Expert Class
Posts: 471
|
posted June 02, 2002 08:22 AM
Edited By: zx12zx11 on 2 Jun 2002 09:37
So are ya calling me a FOOL for posting that response? And yes so everyone knows Kazaa does have spyware in their software. You can and get the stuff at Kazaa run a Antivirus on it and be safe(and cheap). No I'm not saying you should go to a site and get anything for free. Be carefull it can bite you in the ass not to mention bite your hard drive in the ass also.
|
zx12zx11
Expert Class
Posts: 471
|
posted June 02, 2002 08:32 AM
On a side note if you want a crack for almost any software go to http://astalavista.com/
|
DaveInDaytona
Pro
Posts: 1696
|
posted June 02, 2002 08:33 AM
Edited By: fish_ANTLERS on 2 Jun 2002 10:28
If you use Kazaa go with the version without spyware and adware. LINK REMOVED
____________
DaytonaSportbikes Forum
|
fish_ANTLERS
Administrator
The Truth is Out There
Posts: 21896
|
posted June 02, 2002 09:30 AM
It is the policy of this website to not promote WAREZ. Any links to WAREZ will be removed.
(Just to clarify)
|
12RPilot
Pro
Posts: 1094
|
posted June 02, 2002 09:40 AM
What the hell is WAREZ?
____________
If you aren't an AMA member, you're part of the problem.
NESBA #209
http://www.bikepics.com/members/12rpilot/04zx10r/
|
fish_antlers
Administrator
The Truth is Out There
Posts: 21896
|
posted June 02, 2002 09:55 AM
Warez=Pirated software
|
daveindaytona
Pro
Posts: 1696
|
posted June 02, 2002 12:56 PM
Sorry fish, didn't want to cause trouble, just trying to help. I use it for mp3's.
Dave
____________
DaytonaSportbikes Forum
|
fish_antlers
Administrator
The Truth is Out There
Posts: 21896
|
posted June 02, 2002 08:15 PM
so do I.....
|
zx12zx11
Expert Class
Posts: 471
|
posted June 03, 2002 06:45 AM
I was not trying to stir up a bunch of shit or cause trouble, that's not my style. I was just saying that there is more than one way to get free antivirus software. Steve
|
zx9r
Expert Class
Posts: 227
|
posted June 03, 2002 09:26 AM
My laptop is screwed after getting the kazaa virus. I erase all of the files and they come back. as a matter of fact they are copying faster than I can delete them. It copies files over and over and over. I have like 3000 files that have been copied to my c drive.
I have downloaded that bull gaurd fix and it says it is deleting them but then they come back. my memory is almost gone and I cant even turn it on without it getting worse.
this sux. I wish i never used kazaa. there!!! hows that fish??
____________
-----00 GREEN 1270-----
|
fish_antlers
Administrator
The Truth is Out There
Posts: 21896
|
posted June 03, 2002 05:59 PM
kazaa isnt a virus, it's a download site much like napster that allows you to get pirated software. They have antivirus software, but it is most likely riddled with viruses as hackers would have had to crack the sofware to post it there.
The virus you have most likely has nothing to do with Kazaa.. my comment re: kazaa is that we feel strongly that you shouldnt pirate software.
re: your virus... you should visit any one of the sites which freek posted at the top of this thread to clear it for free, then invest in some good antivirus software to protect yourself.
I dont understand your comment zx9r.
|
redelk
Moderator
Please... speak to the hand.
Posts: 3212
|
posted June 03, 2002 07:37 PM
An American perspective....
... of those silly, silly Canadians.
I don't think fish was trying to be a "dick" (even though some feel he's nothing but...) about cracked software and viruses. I understand his view on the software thing. It's one thing to buy a copy of overpriced software and put it on more then one computer. It's a completely different story when one posts the same software on the web. I too, do not believe this site should inform, encourage or in anyway promote the downloading or use of software from these sites.
I know first hand on how extreme the cost of software can be. We have two programs here that have a combined cost over TEN THOUSAND DOLLARS. Each one consists of one or two CDs, both are memory hogs and technical support costs several hundred dollars a year. We don't pay it since all one gets is someone that calls you back after a two day wait and tells you that is the fault of your computer or other software. Upgrades for this crap can cost up $900! We also have no alternative programs we could use.
In the case anti-virus software, I can not believe that someone would complain about the "expense". I really can't. The PC-cillin site was nice to use, but in reality, it proved to me that I needed a far more effective anti-virus program.
For a mear $30, I get a year's worth of McAfee's Virus Scan Online. It removed several viruses that PC-cillin couldn't. It also detects and addresses viruses the instant I get them. Since I'm online for 14-16 hours and get shitloads of e-mails with attachments (both business and personal), it's not that uncommon to get one or two a day.
No, the online program doesn't have all the wiz-bang features of "store bought" software, but it also doesn't suck up my computer's resources either. The bottom line is that this latest rash of viruses are propagating fast and over a wider area the any that have come before them. They are also more destructive.
As cheap as any form of legitmate anti-virus programs and software is, it would be foolish to not just get the real thing and be done with it. Sure, cracked software might work and it's cheaper, but what do you REALLY get? Maybe those who actually write computer code would know, but then again, you normally don't see their computers loaded up with software from those sites. Maybe you do, but I doubt it.
____________
There are only three sports: bullfighting, motor racing, and mountaineering; all the rest are merely games.
-Ernest Hemingway
|
|
|
HOME
NEW TOPIC