Forum Moderators: phranque
Ahemmm.... ehrr.. how are you getting along with your hosting company?
not sure what you are asking?
I was having problems with the way my email was set up, but finally found a tech who knew the answer - simple answer, too. Actually, I was speaking with the tech about my set up shortly after receiving these spoofed emails and I mentioned it then. However, he didn't comment on it and I hadn't checked my log files then.
1) What is the simplest way to determine if a machine or network is infected? What about looking for the Shimgapi.dll file in the %System%\ directory?
2) Most of the talk is about prevention which is the most important thing. However, what are the options for "removing" the virus from the network? I can always get the tool and use it on individual machines.
Many thanks!
I suggest you just follow the steps at either
Norton AV where it is known as "Novarg"
[securityresponse.symantec.com...]
or
McAffee were it is known as "W32/Mydoom@MM"
[us.mcafee.com...]
Then install either of their products with frequent updates on the server and or all machines.
btw I think norton has a download tool which you can install and use to test and fix on a machine by machine basis .. should be pretty straightforward but with infected machines thats often not the case :-)
best of luck .. plus please stop them transmiting while you are checking / fixing them :-)
Thanks for the tips, your suggestions are already in place and I've already read up front to back on NAV's page about the virus. I was looking for a little more. But, from my reading and research ... there really isn't much more that can be done I assume.
Thanks.
I assume we are in the same general business of tourism.
What I find really interesting is that the e-mail we use for reservations is receiving thousands of MyDoom e-mails whereas our webmaster e-mail for another domain that is published on every page of a 100 page site is getting very few. Those viruses that it does get are the M$ ones (forget their designation) or Klez which are self opening.
This seems to indicate to me that "your average user" is still innocent enough to open attachments and not update their AV software on a regular basis whereas the webmaster people don't open attachments but also don't update or don't have AV software.
Thats infact whats happening, your average user/holiday maker that has your main general email, will be most lightly be infected duo to the fact most are not clued-up on the internet security industry and how to protect your self adequately.
As for your webmaster email adress on the front page of many sites/pages? will be only receiving contacts mainly for users that have something to say about your site, these people mainly coulb be other webmaster or IT professional and so on, and a trickle of your avg. net surfer.
email siphon systems that crawl the web for meails to spam too will be mainly servers and these will be less lightly to be infected as their supposed to be fortrified with AV/AT apps and firewalls etc and updated regularly by the administrator. Where as a home user will probably have NAV 2003 for arguments sake on dial-up and rn't going to be bothered to download the 4megs or so update file in some cases, which could take several hours to download. So home users for this reason and many more, r several time lightly to be infected as either they don't have a AT/AV utility to deal with viruses & trojans or do not bother with the weekly virus updates.
"Thats my 2cents" as u americans will say.
Keep up the good work WW
Sorry. It had indeed been my intention to clarify, but I ran into problems (not virus-related).
In a situation like yours I would have contacted one particular person at my hosting company and asked him if they might have intenal security problems. That may happen to any company. I seem to remember that one member had problems with a dishonest employee at his hosting company and that those problems were solved in cooperation with the owner of the hosting company.
( I can't find the exact resource, but it's been said that this virus is the most socially engineered to date and the article speaks solely to that topic ).
Oppose that to what we know about those who ( for whatever reason ) find themselves with an open attachment running rampant on local machine(s). We know many, many folks find themselves in this position. :(
Now throw in the most socially engineered virus and the problem is compounded.
The disparity between those who do ( intentionally or not ) and those who do NOT ( without scanning first ) open attachments is the window of opportunity that needs closing.
Greetings,
Herenvardö
In a story that would completely exonerate the Linux community, accused by SCO of perhaps being behind this week's e-mail virus, the Moscow Times is carrying a story this morning that the first e-mails infected with MyDoom [trace] back to addresses with Russian Internet providers
MyDoom, the fastest-proliferating computer virus ever, has been traced to Russia. Using location-sensing software, Kaspersky Labs has traced the first e-mails infected with MyDoom back to addresses with Russian Internet providers.
I finally got sick of it and hacked together my own SMTP server. I thought I would post info here in case somebody with gumption wanted to use the ideas to implement a real live server. might not be anything new, but i have had some luck. my policies in place are a little aggressive but what the hey.
Here is my process of clipping mail before wasting any resources on spam filtering and virus scanning:
1) check source ip against black list. this is pretty common but i eventually want my server to learn which ips are sending bad stuff and react.
2) actually validate the "from" address. i tried actually connecting to the sender's smtp server to validate email, but this was way overboard. basically it restricts incoming from addresses to a simple regex that only likes "normal" addresses, a subset of the rfc spec.
3) compare the country of origin of the source ip to the country location of the email domain.
4) only allow valid TO: addresses, if a valid recipient is not specified in the rcpt to: command then immediately issue 500
5) all error commands reported back to issuing server include telephone number and contact name, in case a real person trying to send a valid email gets clipped and wonders "why?" ;-)
6) store activity in mysql database.
if an email makes it past the gate, then it gets virus scanned and spam analysed/filtered.
so, on thursday i pointed a couple of domains at it to test. carefully watching the activity, haven't seen anything useful get blocked. the nice thing is that after 6,506 emails, 4,868 of them were dropped immediately without ever getting the DATA command. that is 75%. A REAL savings on server load. before, 90% of the mail would come in and have to go through content and virus scanning, which was beyond red-lining the capacity of the machine.
i realize it likely isn't for everyone, but frankly i am sick to death of all the spam and virus infected mails.
take care,
Waitman
MyDoom, the fastest-proliferating computer virus ever, has been traced to Russia. Using location-sensing software, Kaspersky Labs has traced the first e-mails infected with MyDoom back to addresses with Russian Internet providers.
So I'm the virus writer (for arguments sake!).
I upload the virus to some hijacked "zombie" machine.
Done.
Anyone got a procmail recipe for the new strain that uses the random file names? I had one that I thought was working, but it's only catching the old type with the known file names.
A quick G search for 'mydoom procmail' brings up lots, and they work. Wave goodbye to lots of CPU time for a while, however. All I've done is add .zip to the list of usual suspect cruddy extensions that get filtered, at least until this thing abates somewhat.
So I'm the virus writer
Greetings,
Herenvardö
PS: Please do not misinterpret me. I don't want to offend mods. Their work consists in removing the barbarities I was going to post, so I simply censured myself ;)
I'm not supporting virus writing etc, but after all the viruses that I (even as a linux user) have been bombarded by that exploit Windoze holes I think it would have been nice to see M$ getting some of there own medicine.
I'm not supporting virus writing
Greetings,
Herenvardö
> Virus makers are a plague in the web [...] even when they try to justificate themselves
> There is nothing bad about writting virus. The problem comes when the virus are set free.
> I made once a virus [...] I sent it to all my friends
> The only way to make the screen disappear was to click any of the links or un-plugging the alimentation cable of the computer. In this case, the screen appeared again at each boot, until a link was clicked.
> I've nothing against creating viruses, but a lot against using them to harm people.
And you seem to think that you're justified in infecting friends' computers and hijacking them until they do what you want? Just because it's in their best interest? You don't consider this the least bit harmful?
If this is what you do to friends, I don't want to even know what you do to enemies... You should take your own advice:
> Beware what you say...
You're an interesting character, Herenvardö...
public class worm {
_ public worm(){
___ while (1==1){
_____ worm w = new worm();
___ }
_ }
}
//__underscores added to tabulate the text
Greetings,
Herenvardö
I use Norton AntiVirus 2003 which is up-to-date as I pay for the subscription. It came with a few months free with the computer. Every time I get a virus sent to me I have to deal with a warning message and manually quarantine and then click finish.
I have tried all the settings including 'Try to repair the silently quarantine if unsuccessful'. It makes no difference. The word silent must mean something different to Norton's programmers to what it would to me.
It has been completely tempting to switch the virus protection off because of the time taken (20 minutes this morning) to quarantine all the emails.
Think about a novice user, Norton may get uninstalled. This only helps the spread of the virus.
Do a Google search for it....there's quite a few people here that use it.
Oh....and I agree about Norton. If it's got rid of the damn thing it doesn't need to wait for a round of applause each time :)
Off to find mailwasher...
Greetings,
Herenvardö
