I also seem to be getting similar - or the same?- virus sent to me and it is being intercepted and destroyed by my ISP (ic24.net.) They say the virus is Win32/[EMAIL PROTECTED] OR Win32/[EMAIL PROTECTED] and it has come from various senders including [EMAIL PROTECTED] (today), [EMAIL PROTECTED] (also today), [EMAIL PROTECTED](earlier today),and [EMAIL PROTECTED] and others during the last few days. Ic24.net advise that I do nothing as they have intercepted and destroyed the infected emails, but I am concerned about how long it will be before one gets through to me!! Any advice from you guys would be gratefully received.
Basic advice is to never open a message from an 'unknown' source ... although we are all tempted to do so ( being curious, etc, which the 'spammer' relies on ).
Set up your own 'spam' address ... that is a filter to an address that picks up anything suspicious.
This is in addition to anything done by your ISP or spam software.
You can then see the 'odd' looking emails received as one bunch, and then decide on action. Which is nearly always - bin it !
If you are more confident load the suspicious email into an editor, and see what it consists of. If in doubt - bin it !
Remember, real messages will get to you anyway. As the sender will contact you again, or by other means. So don't worry about losing a valuable message.
All of the addresses you quote above could be valid. As they do make sense as names, and are not random letters or numbers in some combination.
Yet, anything from 'hotmail' is suspicious, ( apologises to genuine hotmail users :-) ), as these are easily available.
The 'cant.ac.uk' is Canterbury University, as Universities are 'ac.uk' so it could be a genuine student, or more likely as false 'spam' address.
Your Ic24.net are right in that they will try to intercept suspicious emails, as they seeing the overall activity that is going on, but no system is perfect.
If you are really interested in reporting 'spam' or fighting back with understanding, then there are some very good web sites which give all this information for free. Just do a search on 'anti-spam' or a similar query. It is interesting reading.
----- Original Message ----- From: "Robert Newson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, March 30, 2004 6:44 PM Subject: Re: [ql-users] 41K virus
Malcolm Cadman wrote:think
> In message <[EMAIL PROTECTED]>, Robert Newson > <[EMAIL PROTECTED]> writes > >> Dilwyn Jones wrote: >> >>> While downloading my emails tonight I noticed it was slow and the >>> stats said I seemed to be sending about 10 times as much data as I was >>> sending. Yes, I had one of the hundreds of 41K viruses ("message >>> failure") worms or virus, whatever they were, probably emailing >>> everyone in sight from my address book. >> >> >> Interesting...tonight I just checked my spam bin and found a message >> of 40k with the following header: > > > ... etc ( cut ). > > Yes, that is what spammers do. They take a 'legitimate' address, or a > part of, and use it in the 'From:' address. > > The actual sender may not know anything about it.
Viruses are also nasty:
I've just got a bounced virus message as the "sender" had used my eaddr as the return. I've also got the same virus directly, from a different name, but the same IP addr. Based on the eaddr that bounced the message, II may know the infected machine
-- Malcolm Cadman _______________________________________________ QL-Users Mailing List
