A few days ago, and possibly still continuing, there was a *glitch* (for lack of a better term) of some kind on the net. For a day, I couldn't get to many websites, but some I could just fine. My ISP was also sporadic. I later found out I was not the only one that was experiencing it. The klez worm this time around is doing some odd things that it didn't do some months back when it was first out. Something I posted to an email list I'm an admin for is below: ------------------------------------ List members, I'm sure most of you know by now about some mindless list member from the address of ********************** and the vir*s problem he started.
For those of you that do not, even after the countless posts on the subject, he refused to use an AV program (or update it) and of course got infected with the Klez worm. This worm went around some months back, but came back with a variation this time. Symantec's website has added it to their HOME page, which is rare & indicative of it's severity this time. http://symantec.com/ The variation this time is the worm CHANGES the "FROM:" line in infected emails to random addresses that either come from their address book, or from some other unknown source. Note: YOU ARE NOT GETTING THESE VIR*S EMAILS FROM THE LIST, OR FROM ANY OF YOUR LIST ADMIN's!!!!! I have received numerous complaints about people being sent this vir*us allegedly from the list, all the admin's, & even myself! If you look at the 'properties' of the email and look at the FULL email header, you will see his address shown in the "From:" area and NOT mine, ours, or any of your other fellow list members. HE is the responsible party for this. I personally have received it from him over 30 times in two days, and of those emails I received, some of them even showed it was from MY address and other Techassist addresses including the list! But, as stated above, when you look at the extended headers, you will see HIS email address as the culprit. It will of course be of no use to reply back to these subjected emails stating "you have a vir*us", etc, etc, because you will be replying back to the WRONG address and not to him. Rest assured he has been removed from the list, we do NOT need list members like that here. :-) Unfortunately, the damage he has done, by not using an AV program or updating it "is done" and nothing can be exercised now to remedy that. Stay safe! (Please do not reply to this email on list). ------------------------------------------- The worm and the internet 'glitch' could possibly be related. Since this Matt person is on both of our lists Jeff, he probably did something stupid and got the worm. -Clint God Bless Us All Clint Hamilton, Owner http://OrpheusComputing.com � From: "Jeff Dougherty" <[EMAIL PROTECTED]> Good day. I am not sure if there is a vir*s of some sort, glitch, or what. But I am receiving several sub*cribe commands from several lists. Here are some examples. It looks like someone is using my email addresses and his real name, which would be really stupid to use his real name. Does anyone know if there is something going on out there>? The original message was received at Sun, 28 Apr 2002 19:50:42 -0500 from aishdas@localhost ----- The following addresses had permanent fatal errors ----- [EMAIL PROTECTED] ----- Transcript of session follows ----- 451 virtual.co.il: Name server timeout Message could not be delivered for 1 day Message will be deleted from queue s*bscribe yhe-undhalakha Matt S. I am receiving several of these yet I am not sending any email there. Or is there a v*rus this Matt guy may have that is doing this? Any input appreciated. Jeff ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
