Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

OT: to scan for or remove email worm

2 views
Skip to first unread message

Teeb

unread,
Sep 20, 2003, 12:49:47 AM9/20/03
to
http://vil.nai.com/vil/stinger/

This is a McAfee program that will scan for the current email worm and many
old ones as well. It will tell you if you have been infected and will help
you get rid of it if you have it. READ INSTRUCTIONS COMPLETELY BEFORE YOU
PROCEED!!! If you are at all unsure about using this for any reason, find
someone else to do it for you who may know more about it. I will NOT be
responsible if someone screws up their machine!!

Teeb


Michele Satanove

unread,
Sep 20, 2003, 4:14:47 AM9/20/03
to
Well, I'd sure like to know why my completely up-to-date McAfee antivirus
program (the complete kit and kaboodle, i.e. NOT free) hasn't been catching
that #*#&%^ swen worm or virus or whatever it is. I'm just deleting the
messages as they come in, but I must have had about 40 of them today alone.
I don't like this at all...

Michele S.
Tibs, Tika, Zamboni
Todd-the-Dog
and Maxi & Mandi (the budgies)


"Teeb" <goa...@noway.com> wrote in message
news:vmnn3qn...@corp.supernews.com...

Teeb

unread,
Sep 20, 2003, 9:31:01 AM9/20/03
to
It's not going to catch it if you haven't infected your computer with it. I
don't generally use McAfee but it probably has a method to scan attachments
although since you already know what this mess is, you haven't opened any so
it's not installed, thus there is nothing for it to catch on it's normal
scan. That's a good thing, lol.

Teeb (afraid to hit *receive because I know there's probably a couple
hundred more waiting for me..)

"Michele Satanove" <ms...@shaw.ca> wrote in message
news:X%Tab.992825$ro6.19...@news2.calgary.shaw.ca...

Angela

unread,
Sep 20, 2003, 12:08:04 PM9/20/03
to
Mcafee does scan attachments for viruses if it's set to do so.

If your email program is not set to automatically download attachments, it's
not going to catch them. They aren't downloaded onto your computer yet. They
are waiting on the server for you to download them. Just as it will not alert
you to them if you read your mail at mail2web, UNLESS you download them, or
open an infected email.

It's safest to have your computer set up to NOT automatically download
attachments so you can manually delete any you feel are not safe. Mcaffee will
catch (in theory) them when you attempt to download the ones that are infected.


What email program are you using?

Angela (Aol.com doesn't hop!)

www.rabbitadoption.org Rabbits & small animals for adoption--worldwide links,
including vet referrals & other rescues, care tips, mail order products, etc.

Teeb

unread,
Sep 20, 2003, 12:40:57 PM9/20/03
to
I use Outlook Express.. and do not have it downloading attachments, it just
lets me know one is there, so it's not a problem. I ran the scan just to
check, as it looks for many others along with this new one and I don't have
anything installed, virus or worm. I run a program continually in the
background that will alert me if another program tries to install something
that I haven't specifically asked it to.. that is a big help with some of
these stupid websites.. have you ever gone to one you've never been to
before only to find it's made itself your homepage and installed spyware
cookies etc?? sheesh.

Teeb

"Angela" <jessi...@aol.comhop> wrote in message
news:20030920120804...@mb-m23.aol.com...

scGram

unread,
Sep 20, 2003, 1:16:33 PM9/20/03
to
Boy how I agree with your thoughts ... thankfully PC-Cillin has caught them all.
Yesterday I had 102 and today I had 74 and the day is only half over. I am
really tired of this. These people who put these things out are SICK.
--
{)(}
(*.*) Dori ...
{"}{"} BB and Cissy

email me = dorineu at writeme dot com
--------------------------


"Michele Satanove" <ms...@shaw.ca> wrote in message
news:X%Tab.992825$ro6.19...@news2.calgary.shaw.ca...

Anita

unread,
Sep 20, 2003, 1:41:04 PM9/20/03
to
Has anyone actually been alerted that the attachments contain viruses? I
haven't received an alert. Nor did Trend Micro find any viruses.

I download mail in plain text only. Sometimes it is inconvenient, but it
protects from some viruses. I am trying to figure out why some people are
getting virus alerts while I am not.

I am receiving the suspicious email through my outdoor rabbit address. The
only places I use that address are here and on Yahoo. The "to" line is
deceptive. It apparently is a personal list. I've closed my mailbox at my
online domain. I'll be glad to send people my private email if they need or
want it.

Anita


j...@invalid.address

unread,
Sep 20, 2003, 2:10:07 PM9/20/03
to
"Anita" <a...@outdoorrabbit.com> writes:

> Has anyone actually been alerted that the attachments contain
> viruses? I haven't received an alert. Nor did Trend Micro find any
> viruses.

I've never gotten an alert, I just check the message source
periodically to see what's going on, especially if the mail looks
suspicious. For example, a bounce message for something I didn't send,
Windows security patches (I use Linux), etc.

> I download mail in plain text only. Sometimes it is inconvenient,
> but it protects from some viruses. I am trying to figure out why
> some people are getting virus alerts while I am not.

I'm not sure what downloading in plain text only would mean in
Outlook. I'm sure it will only display plain text, which might help
protect from viruses in signatures, etc, but I doubt that it's not
putting everything in the message on disk.

Your virus scanner might just not be catching it. When in doubt, look
at the message source and see what's actually there. I'm assuming that
Outlook will let you do that. Sometimes you'll find quite a bit more
in the message source than what's shown to you on the screen.

Another possibility is that your ISP is filtering out the virus
part. I sent mine an example of the bounce scam and asked them to
update their server filters. Now when I get these things I don't get
the attachment any more.

> I am receiving the suspicious email through my outdoor rabbit
> address. The only places I use that address are here and on Yahoo.
> The "to" line is deceptive. It apparently is a personal list. I've
> closed my mailbox at my online domain. I'll be glad to send people
> my private email if they need or want it.

The To: line can be anything at all. The mail server doesn't route
mail based on that line, it routes it based on the instructions it got
when accepting the mail. I generally filter out anything that doesn't
have my email address (or the addres of a mailing list I'm on).

Joe

Anita

unread,
Sep 20, 2003, 2:31:25 PM9/20/03
to
Joe, I use PC-cillin by Trend Micro. After finding PC-cillin, I could never
go back to McAfee or Norton. PC-cillin updates several times a week. The
program checks for updates frequently. I would be surprised if anything
could get past it unless it was masked or if the worm redirected to an
internet site. Universities in our area are now using Trend Micro because
it is very good.

Since you've not received any alerts and I haven't, maybe these messages are
not really virus/worm-laden. Or maybe the attachment redirects to a web
address that contains every virus/worm known to man.

Gosh... my curiosity is killing me. No, I'm not curious enough to open one
of the messages. I'll send them to Trend Micro to see.

Anita

<j...@invalid.address> wrote in message
news:m3ekyb4...@invalid.address...
...


> I've never gotten an alert, I just check the message source
> periodically to see what's going on, especially if the mail looks
> suspicious. For example, a bounce message for something I didn't send,

> Windows security patches (I use Linux), etc....


j...@invalid.address

unread,
Sep 20, 2003, 3:03:26 PM9/20/03
to
"Anita" <a...@outdoorrabbit.com> writes:

> Since you've not received any alerts and I haven't, maybe these
> messages are not really virus/worm-laden. Or maybe the attachment
> redirects to a web address that contains every virus/worm known to
> man.

Well, I don't receive alerts because I'm not running anything that
would give them to me. I run Linux, not Windows, and the various virus
detection programs run on Windows. There probably is something I could
run, but I don't bother because Windows virii won't run on Linux.

Likewise, I'm not running Outlook, which is the car these things
drive. My wife does run Windows, but she uses Netscape (with
Java/Javascript turned off in mail and news) rather than Outlook, and
hasn't been bothered so far.

> Gosh... my curiosity is killing me. No, I'm not curious enough to
> open one of the messages. I'll send them to Trend Micro to see.

It could be that your ISP is removing the attachments before sending
you the mail. That's not uncommon.

You could also just open your mail file in a plain text editor (NOT
Word - it has the capability to run VB scripts too), and look at it.

Joe

Teeb

unread,
Sep 20, 2003, 3:19:03 PM9/20/03
to
It's not a *virus* it's a *worm*. They are different. Some programs will
scan the attachment before you download it so you know know what it is but
sometimes that doesn't work. The only way otherwise a scan will pick it up
is if it's already installed itself on your computer. These "email worms"
are created generally to do nothing more than make nuisance of themselves
but this current one can also take advantage of a security flaw in Windows
and can allow someone to get into your files. If you go to the MS update
page and have it scan your computer for new security updates, if you need
them it will tell you. There is a fix for this current flaw. Then while the
worm could still install into your computer, it can do nothing more than use
your system to send other emails to addresses it finds in your email
program. That is how it becomes so massive.. it sends to your addresses,
gathers news ones elsewhere if someone picks it up, adds those addresses,
and so on and so on.
If there is an attachment to an email in the subject matter currently being
sent as, chances are it DOES contain the worm. If you don't see an
attachment, you probably have your settings to not accept exe attachments,
which is the best way to prevent a problem.

Teeb

"Anita" <a...@outdoorrabbit.com> wrote in message
news:121bb.42976$NM1....@newsread2.news.atl.earthlink.net...

Robin

unread,
Sep 20, 2003, 4:22:55 PM9/20/03
to
i agree--i hate that--i regularly run spybot to get rid of all these
annoying progs that install themselves--what prog do u use to alert you the
installation before it happens?--thanks
-Robin

"Teeb" <goa...@noway.com> wrote in message

news:vmp0p94...@corp.supernews.com...


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.520 / Virus Database: 318 - Release Date: 9/18/2003


Teeb

unread,
Sep 20, 2003, 7:08:45 PM9/20/03
to
webroot spysweeper.. they have a free version and a subscription service as
well. You can set preferences of all kinds.. prevent cookies.. or to only
allow certain cookies you might want to be saved.. all kinds of stuff along
with notifying you if a website is trying to install something. I have mine
set to sweep for spyware around 2am every day..

http://www.webroot.com/wb/downloads/index.php

Teeb

"Robin" <further30...@hotmail.com> wrote in message
news:zG2bb.6668$Uv2....@nwrdny02.gnilink.net...

Robin

unread,
Sep 20, 2003, 9:11:51 PM9/20/03
to
thanks very much
-Robin

"Teeb" <goa...@noway.com> wrote in message

news:vmpngd6...@corp.supernews.com...

scGram

unread,
Sep 20, 2003, 10:19:57 PM9/20/03
to
Anita ... didn't you say you use PC-Cillin? That's what I use also and a box
comes up every time an email contains a virus. The box tells what the message
subject is and the name of the virus. It also says it has deleted it.
I would like to have your email address ... Send it to the address under my
signature (you know how to edit it)

--
{)(}
(*.*) Dori ...
{"}{"} BB and Cissy

email me = dorineu at writeme dot com
--------------------------

"Anita" <a...@outdoorrabbit.com> wrote in message

news:Qi0bb.42951$NM1....@newsread2.news.atl.earthlink.net...

scGram

unread,
Sep 20, 2003, 10:25:36 PM9/20/03
to
Teeb ... how do you set Outlook express to not download attachments? I can't
find a way to do it.

--
{)(}
(*.*) Dori ...
{"}{"} BB and Cissy

email me = dorineu at writeme dot com
--------------------------

"Teeb" <goa...@noway.com> wrote If you don't see an

Marissa Reedhead

unread,
Sep 20, 2003, 10:41:12 PM9/20/03
to

"scGram" <spam...@stop.com> wrote in message
news:bkj274$28s60$1...@ID-205726.news.uni-berlin.de...

> Teeb ... how do you set Outlook express to not download attachments? I
can't
> find a way to do it.
> --
> {)(}
> (*.*) Dori ...
> {"}{"} BB and Cissy
>
> email me = dorineu at writeme dot com
> --------------------------

Dori,
I found out that you need to click on tools>options>and then click on the
security tab
From there you can click a box that says "Do not allow attachments to be
saved or opened that could potentially contain a virus" Hope this helps,

Marissa


scGram

unread,
Sep 20, 2003, 11:37:57 PM9/20/03
to
Thanks Marissa ... I have that checked now but I hate these viruses and worms
... Some of my family likes to send me photos as attachments and now Outlook
express won't download them cause it says they may contain a virus. I wish we
had a way to designate that a .jpg is not a virus file. It's all so frustrating
and sometimes makes me feel like I don't even want to use a computer when our
privacy is so severely compromised.

--
{)(}
(*.*) Dori ...
{"}{"} BB and Cissy

email me = dorineu at writeme dot com
--------------------------

"Marissa Reedhead" <mree...@shaw.ca>

j...@invalid.address

unread,
Sep 20, 2003, 11:51:10 PM9/20/03
to
"scGram" <spam...@stop.com> writes:

> Thanks Marissa ... I have that checked now but I hate these viruses
> and worms ... Some of my family likes to send me photos as
> attachments and now Outlook express won't download them cause it
> says they may contain a virus. I wish we had a way to designate that
> a .jpg is not a virus file. It's all so frustrating and sometimes
> makes me feel like I don't even want to use a computer when our
> privacy is so severely compromised.

I don't want to sound like a Microsoft basher (well, maybe I don't
mind all that much ... :-), but using something other than Outlook to
read mail and news might make life a lot easier to deal with.

For example, my wife runs Windows, but uses Netscape rather than
IE/Outlook. She gets pictures and other attachments from lots of
people, but doesn't get affected by malware, because Netscape doesn't
have the kind of things designed into it that Outlook/IE does.

Joe

scGram

unread,
Sep 21, 2003, 1:45:31 AM9/21/03
to
Thanks Joe ... I used Netscape for many years but got tired of sites that told
me they could only be viewed with IE. Does your wife run into that? ... I'm not
sure, at this point, that I feel like reconfiguring everything and transferring
over all my saved stuff to Netscape again. I guess, if I'm not willing to go to
all the bother, I'd better just shut up and stop complaining about it <g>

I haven't had much trouble with OE until just the past couple of weeks and my
Virus Checker does seem to catch everything.

I would someday like to try a Mac.


--
{)(}
(*.*) Dori ...
{"}{"} BB and Cissy

email me = dorineu at writeme dot com
--------------------------

<j...@invalid.address> wrote in message news:m3ekya3...@invalid.address...

Martha

unread,
Sep 21, 2003, 2:31:01 AM9/21/03
to
Hello Everyone,

I have been using Norton Internet Security (which includes NAV) on my system
since early 2001, and have never been infected. I've had less than five
emails in that time come in with a worm or virus. (I am using Outlook
Express at the moment). Through the NIS I also have a s/w firewall, which I
have found helps tremendously. I would highly recommend one to everyone
(either hardware or software), but especially those with high speed
connections. I see anywhere up to a dozen trojan horse attempts a day (they
are trollers as opposed to directed attacks) but they are of course looking
for any weaknesses in your system.

I'm only guessing here, but I have *always* been extremely careful when
posting messages to newsgroups with my current ISP. When I first started on
the internet 11+ years ago, I wasn't quite so aware of the annoyances that
could result in leaving your address visible - as a consequence, I am
*still* getting spam on that account, even though I haven't used it for any
real correspondence in five years. Jeesh, they've got longer memories than
an elephant! :-) (And I'm much more fond of elephants. <g>)

Anything that comes in on OE is scanned on the way in and I've never had a
problem with a virus not being detected. I have NAV set up to do several
full scans a week, it has an auto-updater and I also tend to click on the
button looking for updates on a daily basis.

I have previously used BlackIce and McAfee, but have found that those both
let nasty things slip though.

I'm not sure if this helps anybody, but I figured I'd throw my hat into the
ring. :-)

Take care,
Martha

For email: AimeeandMartha at yahoo dot com


"scGram" <spam...@stop.com> wrote in message

news:bkjdum$2b2ai$1...@ID-205726.news.uni-berlin.de...

Anita

unread,
Sep 21, 2003, 9:31:07 AM9/21/03
to
Hi, Cissy,

Email address is being sent. My PC-cillin usually catches everything and a
message comes up, like you said. These latest mails don't set off an alert.
Maybe it is because I receive mail in plain text only or my ISP or firewall
are filtering viruses/worms out. I have a feeling if I opened one, I would
learn that there was something there. Curiosity is strong, but I don't like
to tamper with suspicious emails, even by looking under source as Joe
suggested. (It makes me feel like I am playing with a snake with a stick;)

Another Usenet user said that he had also been flooded with the suspicious
emails. He has posted a couple of times to this group and a few times to
other groups. My Dennis, who has never posted to a news group, has still
not received a single email. Grr!

Anita and Jessie

"scGram" <spam...@stop.com> wrote in message

news:bkj1sf$2afn7$1...@ID-205726.news.uni-berlin.de...
> Anita ... didn't you say you use PC-Cillin? ...


Anita

unread,
Sep 21, 2003, 9:54:34 AM9/21/03
to
Dori, I sent a couple of emails to you, but I think both were spam block
addresses. If you'll send me your email address -- the outdoor rabbit
address is still good -- I'll send you my email address and a picture of the
screen house.

Anita


j...@invalid.address

unread,
Sep 21, 2003, 11:34:06 AM9/21/03
to
"scGram" <spam...@stop.com> writes:

> Thanks Joe ... I used Netscape for many years but got tired of sites
> that told me they could only be viewed with IE. Does your wife run
> into that? ... I'm not sure, at this point, that I feel like
> reconfiguring everything and transferring over all my saved stuff to
> Netscape again. I guess, if I'm not willing to go to all the bother,
> I'd better just shut up and stop complaining about it <g>

Netscape 7.x does pretty well, and I don't recall when the last time I
wanted to go to a site and was told that.

Joe

j...@invalid.address

unread,
Sep 21, 2003, 2:12:22 PM9/21/03
to
j...@invalid.address writes:

Another possibility is running something like ZoneAlarm on your
windows box. It will tell you when something is trying to connect out
from your machine, and you can decide to allow or disallow it. You can
preconfigure all the normal stuff like web servers, etc.

My father uses it, and he says it's very revealing. For example, when
he listens to a Clear Channel radio station on the web, a client gets
installed on his machine that connects back out to the ClearChannel
server. He didn't know that was happening until he installed
ZoneAlarm.

You can get a free copy for Windows from
http://www.zonelabs.com/store/content/home.jsp

Might be worth doing, I don't know. It does take NAV and others time
to catch up when a new virus/worm hits.

Joe

scGram

unread,
Sep 21, 2003, 10:14:52 PM9/21/03
to
Thanks Joe: I've heard that ZoneAlarm is a very good program, I didn't know they
had a free copy. I will download it and give it a try.

--
{)(}
(*.*) Dori ...
{"}{"} BB and Cissy

email me = dorineu at writeme dot com
--------------------------

<j...@invalid.address> wrote in message news:m3pthu9...@invalid.address...

0 new messages