Re: Here you have, ;o)

2001-02-14 Thread Geir Magnusson Jr.

"A.T.Z." wrote:
 
 Hi friends,
 
 Just relax.
 
 Wanne know the solution to these VBS things flying around??
 It's so very very very easy, even costs you US$ 0,00

Man, I was hoping for a good riff on getting rid of the risky software
that exposes millions of users to millions of dollars in data and
opportunity loss from a company that doesn't seem terribly interested in
solving the problem on behalf of their clients

Alas.

 Associate .vbs with notepad so it launched notepad whenever you (or anyone
 else) tries to open it.
 
 I would suggest doing the same thing with .js

This is the 'Raising the Bar' approach : keep those virus writers
challenged  Since no one can see the source code, it makes it a fun
game for both the virus writers and the users - kind of a digital
pinata.  The only question is who gets to swing the stick.

 I would also suggest you get yourself a decent (and recent) piece of
 antivirus software.
 
 No reason to bomb anyone who uses Outlook.. And most certainly no reason to
 bomb me.
 Remember: the person who double clicks the attachment has no wish to do you
 any harm.

True.  But at this point, isn't this bordering on negligence?

"Sorry, I didn't know the gun was loaded."
"Ok.  Just be careful next time."
next time
"Sorry, I didn't know the gun was loaded."


I mean, you could argue that everyone was taken by 'surprise' at the
Melissa outbreak, but isn't this the same problem again?

geir
 
 Bye,
 
 B.
 
 -
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]

-- 
Geir Magnusson Jr.   [EMAIL PROTECTED]
Velocity : it's not just a good idea. It should be the law.
http://jakarta.apache.org/velocity

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




Re: Here you have, ;o)

2001-02-14 Thread A.T.Z.


This is the 'Raising the Bar' approach : keep those virus writers
challenged  Since no one can see the source code, it makes it a fun
game for both the virus writers and the users - kind of a digital
pinata.  The only question is who gets to swing the stick.

Since I cannot edit the M$ code my solution is a good one. Yes, M$ should 
clean up their code.

Rather associate with notepad then to wait until the next .vbs comes out 
and I need to wait until my favorati AV vendor solves it.


True.  But at this point, isn't this bordering on negligence?

If you don't run any AV software?? yep. This is also a stupid user problem. 
Clicking on anything they see. A warning? M$ did learn you to  click OK..
A few questions every user should ask:
- do I expect this to be send
- do I know this kind of attachment
- would I expect an attachment like this from this person
- is my AV software up to date

In case of doubt--contact a sysadmin. Some of my customers contact me as 
soon as they get something they don't trust.

There really is a job to do for sysadmins to keep their users informed. 
Warn them, teach them to think twice before opening an attachment.

I mean, you could argue that everyone was taken by 'surprise' at the
Melissa outbreak, but isn't this the same problem again?

Yes it is the same. And Iloveyou and all the others. One thing, they all 
use .VBS so I can capture them all with about 20 mouse clicks.

geir

Bye,

B.


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




Re: Here you have, ;o)

2001-02-14 Thread Clay Atkins

Hm.

Well, I'm gonna apologize for yelling at you.  I lost my temper.  Sorry.


At 02:56 AM 2/14/01 -0800, you wrote:
Clay Atkins [EMAIL PROTECTED] wrote:
 
  WOW!
 
  What a rude little twit you are.

Hear hear... Bah...

  a) I didn't write the virus.

Well, for sure, since it's around the net since quite some time...

  b) A computer newby in my office used my computer to try to read the
  message, because her netscape wouldn't open the thing; I was at home, sick.

It's not my fault, to prevent further infestations I had to unsubscribe you
from the lists, that creepy VBS is a son-of-a-bitch (not that I care, since
I don't use Outlook and/or a Wintel machine anymore)

  c) You seem to be a smug, cowardly little man.

And you're the most polite person on this planet... Like if I _really_
mailbombed you... Bah, when will people learn how to behave on mailing
lists?

  d) You certainly would behave that way to me, face-to-face, unless you were
  a heavy drinker or drug user.

Oh, ask to the kids who know me for real on the mailing list... I would have
done the same even if the virus came from my roommate (Hi Fede :)

  Unsubscribe me, whatever, stick it in your ear!

You simply get rid of the virus and re-subscribe

  P.S., I live in Cookeville, TN.  My office is 320 East Broad Street.  I'm
  there most days.  Let's see your courage.

Yeah, whatever, like I had time to get to the middle of nowhere... But if
you want you are more than welcome to have some Lasagna (of course the best
in the entire US since I do them myself, no frozen shit) in Sunnyvale :) :)

 Pier

--

Pier Fumagalli  http://www.betaversion.org/  mailto:[EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




Re: Here you have, ;o)

2001-02-13 Thread Clay Atkins

WOW!

What a rude little twit you are.

a) I didn't write the virus.

b) A computer newby in my office used my computer to try to read the 
message, because her netscape wouldn't open the thing; I was at home, sick.

c) You seem to be a smug, cowardly little man.

d) You certainly would behave that way to me, face-to-face, unless you were 
a heavy drinker or drug user.

Unsubscribe me, whatever, stick it in your ear!

P.S., I live in Cookeville, TN.  My office is 320 East Broad Street.  I'm 
there most days.  Let's see your courage.


At 12:22 PM 2/12/01 -0800, you wrote:
Clay Atkins [EMAIL PROTECTED] wrote:

  Hi:
  Check This!

DELETE THOSE TWO MESSAGES! THEY CONTAIN A VIRUS IN THE ATTACCHED VBS FILE.
Clay Atkins has been already unsubscribed from ALL mailing lists, and I'll
take care of mailbombing him privately later on today...

 Pier

--

Pier P. Fumagalli  mailto:[EMAIL PROTECTED]

Return-Path: [EMAIL PROTECTED]
Delivered-To: moderator for [EMAIL PROTECTED]
Received: (qmail 4627 invoked from network); 12 Feb 2001 20:06:36 -
Received: from mail.london-1.starlabs.net (HELO 
server-22.tower-4.starlabs.net) (212.125.75.12)
   by h31.sny.collab.net with SMTP; 12 Feb 2001 20:06:36 -
X-VirusChecked: Checked
Received: (qmail 4318 invoked by uid 0); 12 Feb 2001 20:02:25 -
Date: 12 Feb 2001 20:02:25 -
Message-ID: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Subject: WARNING. You sent a potential virus or unauthorised code
X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N

The MessageLabs Virus Control Centre discovered a possible
virus or unauthorised code (such as a joke program or trojan)
in an email sent by you.

Please read this whole email carefully. It explains what has
happened to your email, which suspected virus has been caught,
and what to do if you need help.



Some details about the infected message


To help identify the email:

The message was titled 'Here you have, ;o)'
The message date was Mon, 12 Feb 2001 14:04:53 -0600
The message identifier was 01c801c0952f$1033b6c0$[EMAIL PROTECTED]
The message recipients were
 [EMAIL PROTECTED]


To help identify the virus:

Scanner 3 (NAI Virus Scan) reported the following:

/var/qmail/queue/split/0/659954_2MA-OCTET-STREAM_AnnaKournikova.jpg.vbs
 Found the VBS/SST virus !!!


The message was diverted into the virus holding pen on
mail server server-22.tower-4.starlabs.net (id 659954_982008144)
and will be held for 30 days before being destroyed.



What should you do now?


If you sent the email from a corporate network, you should first
contact your local Helpdesk or System Administrator for advice.
They will be able to help you disinfect your workstation.

If you sent the email from a personal or home account, you will
need to disinfect your computer yourself. To do this you will
need an anti-virus program. We suggest using one of the leading
industry anti-virus packages such as McAfee, F-Secure or Cybersoft,
which cost 15-30 per copy.



Getting more help


You may like to read the Support FAQs at
http://www.messagelabs.com/support/FAQs.htm
These will answer many of the most common queries.

If you believe this message to be a false alarm or you require
further assistance, you can email MessageLabs Support at:-

 [EMAIL PROTECTED]

or contact MessageLabs Helpdesk by telephone on:-

+44 (0) 1452 627766

Please quote the following Virus Pen ID when contacting Support.
 mail server server-22.tower-4.starlabs.net (id 659954_982008144) 


_
This message has been checked for all known viruses by the
MessageLabs Virus Control Centre. For further information visit
http://www.messagelabs.com/stats.asp




-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




Re: Here you have, ;o)

2001-02-12 Thread Pier P. Fumagalli

Clay Atkins [EMAIL PROTECTED] wrote:

 Hi:
 Check This!

DELETE THOSE TWO MESSAGES! THEY CONTAIN A VIRUS IN THE ATTACCHED VBS FILE.
Clay Atkins has been already unsubscribed from ALL mailing lists, and I'll
take care of mailbombing him privately later on today...

Pier

-- 

Pier P. Fumagalli  mailto:[EMAIL PROTECTED]




The MessageLabs Virus Control Centre discovered a possible 
virus or unauthorised code (such as a joke program or trojan)
in an email sent by you. 

Please read this whole email carefully. It explains what has 
happened to your email, which suspected virus has been caught, 
and what to do if you need help.



Some details about the infected message


To help identify the email:

The message was titled 'Here you have, ;o)'
The message date was Mon, 12 Feb 2001 14:04:53 -0600
The message identifier was 01c801c0952f$1033b6c0$[EMAIL PROTECTED]
The message recipients were 
[EMAIL PROTECTED]


To help identify the virus:

Scanner 3 (NAI Virus Scan) reported the following:

/var/qmail/queue/split/0/659954_2MA-OCTET-STREAM_AnnaKournikova.jpg.vbs
Found the VBS/SST virus !!!


The message was diverted into the virus holding pen on
mail server server-22.tower-4.starlabs.net (id 659954_982008144)
and will be held for 30 days before being destroyed.



What should you do now?


If you sent the email from a corporate network, you should first 
contact your local Helpdesk or System Administrator for advice. 
They will be able to help you disinfect your workstation.

If you sent the email from a personal or home account, you will 
need to disinfect your computer yourself. To do this you will 
need an anti-virus program. We suggest using one of the leading 
industry anti-virus packages such as McAfee, F-Secure or Cybersoft, 
which cost £15-£30 per copy. 
 


Getting more help


You may like to read the Support FAQs at 
http://www.messagelabs.com/support/FAQs.htm 
These will answer many of the most common queries. 

If you believe this message to be a false alarm or you require 
further assistance, you can email MessageLabs Support at:-

[EMAIL PROTECTED]

or contact MessageLabs Helpdesk by telephone on:-

   +44 (0) 1452 627766

Please quote the following Virus Pen ID when contacting Support.
 mail server server-22.tower-4.starlabs.net (id 659954_982008144) 


_
This message has been checked for all known viruses by the 
MessageLabs Virus Control Centre. For further information visit
http://www.messagelabs.com/stats.asp






-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]