I've gotten several e-mails that were "FROM" the KR Net that had attachments
over the past few weeks. When I read the e-mails, they all seem very
fragmented, and make a little sense, but not much. The attachments have
been viruses.
As it turns out, the viruses that were sent work like this:
They reside on someone's computer, and look around in all that guys old
e-mails and write a new e-mail using bits and pieces of his old e-mails.
This includes the subject. Sometimes, the virus even uses parts of documents
on the computer, depending on the virus. Then it looks through the address
book and all the e-mails, and picks out people to send it to. It also picks
out an address to be from. The e-mail is now sent, with the virus as an
attachment.
So, this process makes the e-mails sound believable, since they are
pieces of actual e-mails. You may even recognize parts of the e-mail as
what you have read before on KR-Net. I did on a couple.
Here are the things that give it away:
1) The e-mail doesn't make 100% sense.
2) It is unsigned at the bottom, usually. It appears that whoever
wrote it hit send in mid-sentence.
3) The attachment has 2 file extensions, and the second one is .scr
(i.e. wingattach.doc.scr is a virus)
If you are not sure, and you want to open up the file anyways...save it
first, don't just open it. My virus checker doesn't check the attachments
until I do something with them. So, by saving it, the virus checker checks
it out, and the file doesn't get a chance to run before it is caught. If
you run it, there is a slight chance something bad could happen before the
virus checker grabs it.
Hope this helps.
Mark Youkey
[email protected]
Oklahoma City
----- Original Message -----
From: "larry severson" <[email protected]>
To: "KR builders and pilots" <[email protected]>
Sent: Monday, September 29, 2003 11:49 AM
Subject: Re: KR>attachments?
>
> >Did you actually GET attachments
>
> YES!
>
>
> Larry Severson
> Fountain Valley, CA 92708
> (714) 968-9852
> [email protected]
>
>
> _______________________________________________
> see KRnet list details at http://www.krnet.org/instructions.html
