lsj7

Don't open that email from MS about a patch. And don't open any returned or
failed amil deliveries attachments

lsj7

> Hi I have just had 10 emails purporting to come from Microsoft
> with a virus patch Here is the header from one of them. Anyway I
> can stop them? Or screw the person sending them?
>
> It looks so realistic with pretty Microsoft logos etc.
[snip]



W32.Swen.A@mm or W32/Gibe-F, or Worm Swen.A

See how to create a message rule in OE *.

Further information at:
http://www.pcworld.com/news/article/0,aid,112552,00.asp
http://www.microsoft.com/security/incident/blast.asp
http://www.theregister.co.uk/content/56/32327.html
http://www.theregister.co.uk/content/56/32410.html

http://www.symantec.com/avcenter/ven...swen.a@mm.html

"W32.Swen.A@mm is a mass-mailing worm that attempts to spread through
file-sharing networks, such as KaZaA and IRC, and attempts to kill
antivirus and personal firewall programs running on a computer.

The worm arrives as an email attachment. The subject, body, and From:
address of the email may vary. Some examples claim to be patches for
Microsoft Internet Explorer, or delivery failure notices from qmail."

"The worm can also impersonate mail delivery failure notices..."

"The worm spreads through email, KaZaA, IRC, Network Shares, and
newsgroups."

Delete the e-mail. Make sure your AV is up to date. Pass along this
information to those who may benefit from it.

AVG
http://www.grisoft.com/us/us_vir_tt.php#1
Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36939
F-Secure
http://www.f-secure.com/v-descs/swen.shtml
Network Associates:
http://vil.nai.com/vil/content/v_100662.htm
Trend Micro:
http://www.trendmicro.com/vinfo/viru...me=WORM_SWEN.A

And at this newsgroup: alt.comp.anti-virus

Make sure your preview pane is off.
For Hotmail, set your application to only download headers.


Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me,
Windows NT, Windows Server 2003, Windows XP

Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2,
UNIX, Windows 3.x

*Borrowed from George (Bindar Dundat ©)
Posted at: microsoft.public.win98.gen_discussion
Message-ID: <news:vmlsspr64uuc35@corp.supernews.com>

<Quote>
One protection method is to create a message rule in Outlook Express
as follows;
Go to Tools>Message Rules>Mail>New
In the top box) Check "Where the From Line Contains People" and
"Where the
Message has an Attachment"
In the center box) Check "Mark as Read" and "Delete it" and "Stop
Processing
More Rules"
In the bottom box) Click on "Contains People" (in blue) and add
"microsoft.com"
(no quotes).
Do not use "Delete from server" since OE has no way of knowing if
there is
an
attachment until it arrives in your inbox.
If you use any other rules which sort mail into different folders or
otherwise
move the mail from the Inbox, then it is imperative that the above
rule be
moved
to the top of the rules list.
</Quote>

You might consider a new e-mail client such as Mozilla Thunderbird.
http://www.mozilla.org/projects/thunderbird/
More at:
http://www.webattack.com/freeware/misctools

The above from Boomer in another ng

--
lsj7

"Germany is sheerly swallowed up by the merchants and companies, by means of
usury. Usury lives all secure in Germany, and rages as if he were God and
lord in all lands; no one may oppose him."
_____________Martin Luther

Jim Sewell & Debbie Bone

> > Hi I have just had 10 emails purporting to come from Microsoft
> > with a virus patch

LOL,
There are a few hundred more where they came from !
No, I'm not joking !!!!

Jim

PS Open NOTHING that contains an attachment unless you KNOW it's safe.....

John Cutler

Hi people, if anyone has opened thi virus or suspects they might have got
it, here is the solution

http://www3.ca.com/virusinfo/virus.aspx?ID=36939 it is a zip file that one
has to download, but read the text file before you use it

John.



"lsj7" <modus_ponens@ifthenbut.coma> wrote in message
news:XKJab.492$an.234@bignews6.bellsouth.net...
> Don't open that email from MS about a patch. And don't open any returned
or
> failed amil deliveries attachments
>
> lsj7
>
> > Hi I have just had 10 emails purporting to come from Microsoft
> > with a virus patch Here is the header from one of them. Anyway I
> > can stop them? Or screw the person sending them?
> >
> > It looks so realistic with pretty Microsoft logos etc.
> [snip]
>
>
>
> W32.Swen.A@mm or W32/Gibe-F, or Worm Swen.A
>
> See how to create a message rule in OE *.
>
> Further information at:
> http://www.pcworld.com/news/article/0,aid,112552,00.asp
> http://www.microsoft.com/security/incident/blast.asp
> http://www.theregister.co.uk/content/56/32327.html
> http://www.theregister.co.uk/content/56/32410.html
>
> http://www.symantec.com/avcenter/ven...swen.a@mm.html
>
> "W32.Swen.A@mm is a mass-mailing worm that attempts to spread through
> file-sharing networks, such as KaZaA and IRC, and attempts to kill
> antivirus and personal firewall programs running on a computer.
>
> The worm arrives as an email attachment. The subject, body, and From:
> address of the email may vary. Some examples claim to be patches for
> Microsoft Internet Explorer, or delivery failure notices from qmail."
>
> "The worm can also impersonate mail delivery failure notices..."
>
> "The worm spreads through email, KaZaA, IRC, Network Shares, and
> newsgroups."
>
> Delete the e-mail. Make sure your AV is up to date. Pass along this
> information to those who may benefit from it.
>
> AVG
> http://www.grisoft.com/us/us_vir_tt.php#1
> Computer Associates:
> http://www3.ca.com/virusinfo/virus.aspx?ID=36939
> F-Secure
> http://www.f-secure.com/v-descs/swen.shtml
> Network Associates:
> http://vil.nai.com/vil/content/v_100662.htm
> Trend Micro:
>
http://www.trendmicro.com/vinfo/viru...me=WORM_SWEN.A
>
> And at this newsgroup: alt.comp.anti-virus
>
> Make sure your preview pane is off.
> For Hotmail, set your application to only download headers.
>
>
> Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me,
> Windows NT, Windows Server 2003, Windows XP
>
> Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2,
> UNIX, Windows 3.x
>
> *Borrowed from George (Bindar Dundat ©)
> Posted at: microsoft.public.win98.gen_discussion
> Message-ID: <news:vmlsspr64uuc35@corp.supernews.com>
>
> <Quote>
> One protection method is to create a message rule in Outlook Express
> as follows;
> Go to Tools>Message Rules>Mail>New
> In the top box) Check "Where the From Line Contains People" and
> "Where the
> Message has an Attachment"
> In the center box) Check "Mark as Read" and "Delete it" and "Stop
> Processing
> More Rules"
> In the bottom box) Click on "Contains People" (in blue) and add
> "microsoft.com"
> (no quotes).
> Do not use "Delete from server" since OE has no way of knowing if
> there is
> an
> attachment until it arrives in your inbox.
> If you use any other rules which sort mail into different folders or
> otherwise
> move the mail from the Inbox, then it is imperative that the above
> rule be
> moved
> to the top of the rules list.
> </Quote>
>
> You might consider a new e-mail client such as Mozilla Thunderbird.
> http://www.mozilla.org/projects/thunderbird/
> More at:
> http://www.webattack.com/freeware/misctools
>
> The above from Boomer in another ng
>
> --
> lsj7
>
> "Germany is sheerly swallowed up by the merchants and companies, by means
of
> usury. Usury lives all secure in Germany, and rages as if he were God and
> lord in all lands; no one may oppose him."
> _____________Martin Luther
>
>
>

RedHeat

ok Jim lets start a competition to see who gets the most infected mails.
This morning when I checked my mail there were 47 infected mails sent to me,
can you beat that!

Graham

"Jim Sewell & Debbie Bone" <jim@sewell01.fsnet.co.uk> wrote in message
news:bkg1ig$re9$1@news7.svr.pol.co.uk...
> > > Hi I have just had 10 emails purporting to come from Microsoft
> > > with a virus patch
>
> LOL,
> There are a few hundred more where they came from !
> No, I'm not joking !!!!
>
> Jim
>
> PS Open NOTHING that contains an attachment unless you KNOW it's safe.....
>
>

Dean Flain

Hi,
I have been sent ( worm.Automat.AHB) virus 25 times over the last
few days in my e-mail.Nortons anti-virus detected it o.k and was able to
delete them without any problems!!!

Dean Flain.........

"lsj7" <modus_ponens@ifthenbut.coma> wrote in message
news:XKJab.492$an.234@bignews6.bellsouth.net...
> Don't open that email from MS about a patch. And don't open any returned
or
> failed amil deliveries attachments
>
> lsj7
>
> > Hi I have just had 10 emails purporting to come from Microsoft
> > with a virus patch Here is the header from one of them. Anyway I
> > can stop them? Or screw the person sending them?
> >
> > It looks so realistic with pretty Microsoft logos etc.
> [snip]
>
>
>
> W32.Swen.A@mm or W32/Gibe-F, or Worm Swen.A
>
> See how to create a message rule in OE *.
>
> Further information at:
> http://www.pcworld.com/news/article/0,aid,112552,00.asp
> http://www.microsoft.com/security/incident/blast.asp
> http://www.theregister.co.uk/content/56/32327.html
> http://www.theregister.co.uk/content/56/32410.html
>
> http://www.symantec.com/avcenter/ven...swen.a@mm.html
>
> "W32.Swen.A@mm is a mass-mailing worm that attempts to spread through
> file-sharing networks, such as KaZaA and IRC, and attempts to kill
> antivirus and personal firewall programs running on a computer.
>
> The worm arrives as an email attachment. The subject, body, and From:
> address of the email may vary. Some examples claim to be patches for
> Microsoft Internet Explorer, or delivery failure notices from qmail."
>
> "The worm can also impersonate mail delivery failure notices..."
>
> "The worm spreads through email, KaZaA, IRC, Network Shares, and
> newsgroups."
>
> Delete the e-mail. Make sure your AV is up to date. Pass along this
> information to those who may benefit from it.
>
> AVG
> http://www.grisoft.com/us/us_vir_tt.php#1
> Computer Associates:
> http://www3.ca.com/virusinfo/virus.aspx?ID=36939
> F-Secure
> http://www.f-secure.com/v-descs/swen.shtml
> Network Associates:
> http://vil.nai.com/vil/content/v_100662.htm
> Trend Micro:
>
http://www.trendmicro.com/vinfo/viru...me=WORM_SWEN.A
>
> And at this newsgroup: alt.comp.anti-virus
>
> Make sure your preview pane is off.
> For Hotmail, set your application to only download headers.
>
>
> Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me,
> Windows NT, Windows Server 2003, Windows XP
>
> Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2,
> UNIX, Windows 3.x
>
> *Borrowed from George (Bindar Dundat ©)
> Posted at: microsoft.public.win98.gen_discussion
> Message-ID: <news:vmlsspr64uuc35@corp.supernews.com>
>
> <Quote>
> One protection method is to create a message rule in Outlook Express
> as follows;
> Go to Tools>Message Rules>Mail>New
> In the top box) Check "Where the From Line Contains People" and
> "Where the
> Message has an Attachment"
> In the center box) Check "Mark as Read" and "Delete it" and "Stop
> Processing
> More Rules"
> In the bottom box) Click on "Contains People" (in blue) and add
> "microsoft.com"
> (no quotes).
> Do not use "Delete from server" since OE has no way of knowing if
> there is
> an
> attachment until it arrives in your inbox.
> If you use any other rules which sort mail into different folders or
> otherwise
> move the mail from the Inbox, then it is imperative that the above
> rule be
> moved
> to the top of the rules list.
> </Quote>
>
> You might consider a new e-mail client such as Mozilla Thunderbird.
> http://www.mozilla.org/projects/thunderbird/
> More at:
> http://www.webattack.com/freeware/misctools
>
> The above from Boomer in another ng
>
> --
> lsj7
>
> "Germany is sheerly swallowed up by the merchants and companies, by means
of
> usury. Usury lives all secure in Germany, and rages as if he were God and
> lord in all lands; no one may oppose him."
> _____________Martin Luther
>
>
>

Jim Sewell & Debbie Bone

> ok Jim lets start a competition to see who gets the most infected mails.
> This morning when I checked my mail there were 47 infected mails sent to
me,
> can you beat that!


Graham,
Sorry to say that 47 is for beginners.
Over 4 mail accounts, I must be upwardly reaching 1000 now ! It's not just
me, so that's comforting, but seriously, well into the higher hundreds now
!!!

Yours, knackered of pressing delete...

Jim

RedHeat

This is one time I am glad you are beating me Gruppenfuehrer Jim

;>)
Graham

"Jim Sewell & Debbie Bone" <jim@sewell01.fsnet.co.uk> wrote in message
news:bkib1n$l8m$1@newsg1.svr.pol.co.uk...
> > ok Jim lets start a competition to see who gets the most infected mails.
> > This morning when I checked my mail there were 47 infected mails sent to
> me,
> > can you beat that!
>
>
> Graham,
> Sorry to say that 47 is for beginners.
> Over 4 mail accounts, I must be upwardly reaching 1000 now ! It's not just
> me, so that's comforting, but seriously, well into the higher hundreds now
> !!!
>
> Yours, knackered of pressing delete...
>
> Jim
>
>

Dan Holdsworth

On Fri, 19 Sep 2003 23:56:08 +0100, Jim Sewell & Debbie Bone
<jim@sewell01.fsnet.co.uk>
was popularly supposed to have said:

>> > Hi I have just had 10 emails purporting to come from Microsoft
>> > with a virus patch
>
>LOL,
>There are a few hundred more where they came from !
>No, I'm not joking !!!!

Don't I bloody know it! Two "Mailbox overflowing" notes from NTL
in two days, all down to bloody viral email filling up the damn
inboxes. Yes, I can sort it out pretty easily (Procmail, even on
a Solaris box, is a wonderful tool) but it is the sheer hassle; I
may end up having to leave the machine switched on all day to
keep the crap from filling my inboxes up.

--
Dan Holdsworth PhD daniel.holdsworth@ntlworld.com
By caffeine alone I set my mind in motion, By the beans of Java
do thoughts acquire speed, hands acquire shaking, the shaking
becomes a warning, By caffeine alone do I set my mind in motion