Help ! Getting overwhelmed ....................

  • Thread starter Thread starter boomer
  • Start date Start date
B

boomer

by an avalanche of e-mails claiming to be from Microsoft
Cust Support, Internet Mail Delivery, MS Security
Bulletin, Net System, Microsoft, MS i'NET mAIL sTORAGE, MS
Program Security, Public Bulletin,Network Message, etc.,
etc.

The number increases every day. My ISP CATCHES MOST SO
ALL i SEE IS A warning page from them. I immediately
delete without opening.

I have tried to "block sender" on many of these , but it
doesn't seem to work. More come each day.

I also get numerous Swen A worms with some of these which
my anti-virus catches and I quarantine, as instructed.

Please, Lord, or computer expert out there, tell me how to
block these once and forever !!!!!!

Please post answer here, as I have been told NOT to post
my real address here for fear of getting on another attack
list.

Many thanks.
 
I had a quiet night with them. Only 300 attempts. Have given up on trying
to stop them. My exchange server has McAfee installed and it catches them
but like you i have found no way to block them so i don't have to delete
them. charlie
 
charles kuchar wrote / skrev:
I had a quiet night with them. Only 300 attempts. Have given up on trying
to stop them. My exchange server has McAfee installed and it catches them
but like you i have found no way to block them so i don't have to delete
them. charlie
Click to expand...

Theese emails originate from infected machines.
http://www.microsoft.com/technet/security/virus/alerts/swen.asp

You can do the following to keep your inbox clean:
Set up a filter with a mail-filter utility such as MMM3 or mailwasher
(see http://nakawe.sf.net/MMM3 for a description of mmm3-setup complete
with swen-aware filter)

You can do the following to help stop the flood:
Report the emails to the appropriate abuse-department. Appropriate being
the originating IP-adress. See http://www.spamcop.org for information
about how to find out the originating IP-adress if you don't know how to
do that.
There is also a tool called yaspi http://yaspi.sourceforge.net/ that
claims to be able to also report the virus-emails. I think that you have
to set up richochet also though for this to work.

If you report, it might be a good idea to wait a few days between
reporting so that the abuse-department has a chance to deal with the report.

- Veronica Loell
 
I just posted my first message to this group today - just
a couple hours ago. Until then, I had not received any of
the messages such as the ones mentioned here.

Since I posted that first message here, I have received 4
infected messages, 3 appear to be security updates from
Microsoft, and the other was the SWEN virus.

Dan


-----Original Message-----
charles kuchar wrote / skrev:

Theese emails originate from infected machines.
http://www.microsoft.com/technet/security/virus/alerts/swe n.asp

You can do the following to keep your inbox clean:
Set up a filter with a mail-filter utility such as MMM3 or mailwasher
(see http://nakawe.sf.net/MMM3 for a description of mmm3- setup complete
with swen-aware filter)

You can do the following to help stop the flood:
Report the emails to the appropriate abuse-department. Appropriate being
the originating IP-adress. See http://www.spamcop.org for information
about how to find out the originating IP-adress if you don't know how to
do that.
There is also a tool called yaspi
Click to expand...
http://yaspi.sourceforge.net/ that
 
Dan Thomas said:
I just posted my first message to this group today - just
a couple hours ago. Until then, I had not received any of
the messages such as the ones mentioned here.

Since I posted that first message here, I have received 4
infected messages, 3 appear to be security updates from
Microsoft, and the other was the SWEN virus.
Click to expand...

they are probably all the swen virus. i have seen many copies of the
message with a defective attachment, the message appears complete but the
attachment is empty. it scared me for a while because i thought it was
getting past my isp's and my virus scanners, until i realized the message
size was wrong and the attached file was really empty.
 
charles kuchar wrote / skrev:

Theese emails originate from infected machines.
http://www.microsoft.com/technet/security/virus/alerts/swen.asp
Click to expand...
You can do the following to help stop the flood:
Report the emails to the appropriate abuse-department. Appropriate being
the originating IP-adress. See http://www.spamcop.org for information
about how to find out the originating IP-adress if you don't know how to
do that.
Click to expand...

Report immediately, for each message received. You have no way of
knowing if two messages come from the same infected computer, or two
infected computers in the same domain. Swen is written to spread to
computers closely, as as well as worldwide. The longer you wait, the
more computers might be infected from a computer you are getting Swen
from.

IMHO, more infection reports will go to an ISP when you politely wait,
than your duplicate reports produce.

I started reporting each Swen email a week ago, when I was getting 75
- 100 / day. This was a fscking nuisance, but today I have gotten
only 1. It is quicker to report each one immediately, than to
maintain a list of what you report, and know when to wait to follow
up.

There is one and only one valid way to identify the ISP for the
infected computer, which requires that you examine the headers. Here
is an example:

####### Start Example #######

Return-Path: <[email protected]>
Received: from a.mx.xxxx.net (eth0.a.mx.xxxx.net [208.201.249.230])
by eth0.b.lds.xxxx.net (8.12.10/8.12.9) with ESMTP id
h95L6baQ017487
for <[email protected]>; Sun, 5 Oct 2003 14:06:37 -0700
Received: from mail-6.tiscali.it (mail-6.tiscali.it [195.130.225.152])
by a.mx.xxxx.net (8.12.10/8.12.7) with ESMTP id h95L6ZF6000997
for <[email protected]>; Sun, 5 Oct 2003 14:06:35 -0700
Received: from adqy (62.11.181.97) by mail-6.tiscali.it (6.7.019)
id 3F79B1480042D178; Sun, 5 Oct 2003 23:01:27 +0200
Date: Sun, 5 Oct 2003 23:01:27 +0200 (added by
(e-mail address removed))
Message-ID: <[email protected]> (added by
(e-mail address removed))
FROM: "Security Division" <[email protected]>
TO: "Commercial Customer" <[email protected]>
SUBJECT: Latest Network Security Pack
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="vjwtmhybcefqo"
X-Spam-Status: Yes, hits=5.9 required=5.0

tests=ALL_CAPS_HEADER,MICROSOFT_EXECUTABLE,MIME_HTML_NO_CHARSET,
MSG_ID_ADDED_BY_MTA,RCVD_IN_MULTIHOP_DSBL,
RCVD_IN_UNCONFIRMED_DSBL,SPAM_PHRASE_00_01
version=2.43
X-Spam-Flag: YES
X-Spam-Level: *****
X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp)

Microsoft Customer

this is the latest version of security update, the
"October 2003, Cumulative Patch" update which fixes
all known security vulnerabilities affecting
MS Internet Explorer, MS Outlook and MS Outlook Express
as well as three newly discovered vulnerabilities.
Install now to maintain the security of your computer
from these vulnerabilities.
This update includes the functionality of all previously released
patches.
BLAH BLAH BLAH

####### End Example #######

The infected computer, in the example, is adqy (62.11.181.97).

10/6/2003 10:08:03 whois -h whois.ripe.net 62.11.181.97


remarks: | PLEASE CONTACT OUR ABUSE DIVISION ([email protected]) |
remarks: | FOR ABUSE and-or SPAM COMPLAINTS. |


Send this complaint, with full headers, to (e-mail address removed).

There are any number of online whois lookup tools. I use All-NetTools
( http://www.all-nettools.com/tools1.htm ) and Broadband Reports (
http://www.dslreports.com/whois ).

Also, there are several tools which you can install. I use Sam Spade
( http://www.samspade.org/ssw/ ) and TESP ABouncer (
http://www.tesp.com/abounce/ ). Both contain whois and other tools,
and both help you format and send the complaint.

Cheers,


Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.
 
by an avalanche of e-mails claiming to be from Microsoft
Cust Support, Internet Mail Delivery, MS Security
Bulletin, Net System, Microsoft, MS i'NET mAIL sTORAGE, MS
Program Security, Public Bulletin,Network Message, etc.,
etc.

The number increases every day. My ISP CATCHES MOST SO
ALL i SEE IS A warning page from them. I immediately
delete without opening.

I have tried to "block sender" on many of these , but it
doesn't seem to work. More come each day.

I also get numerous Swen A worms with some of these which
my anti-virus catches and I quarantine, as instructed.

Please, Lord, or computer expert out there, tell me how to
block these once and forever !!!!!!

Please post answer here, as I have been told NOT to post
my real address here for fear of getting on another attack
list.
Click to expand...

1) Anti-virus software, regularly updated.

2) Spam filtering software that allows you to block by subject or
body text, and filter out "Microsoft Customer" and "Microsoft Client"
as well as the notices from your ISP.

Jeff
 
You can do the following to help stop the flood:
Report immediately, for each message received. You have no way of
knowing if two messages come from the same infected computer, or two
infected computers in the same domain. Swen is written to spread to
computers closely, as as well as worldwide. The longer you wait, the
more computers might be infected from a computer you are getting Swen
from.
Click to expand...

Perhaps I did not state clearly what I meant. I report all emails on day
1 then I just throw them away on day 2-4 and report all on day 5.
Actually you will typically recieve 2 messages from the same computer
within a very limited timeframe, i.e. even people with dialups will not
have redialed inbetween attempts. Anyway any reporting helps, 1 less
computer with SWEN is a lot less crap on the internet...
 
Back
Top