- NANOG - lists.nanog.org

To send or not to send 'virus in email' notifications?
by Joe Maimon 20 Aug '03

20 Aug '03

Considering the amount of email traffic generated by responding to forged virus laden email from culprits like sobig should email virus scanning systems be configured to send notifications back to sender or not?

11 11

End of thread ; WAS: RE: virus or hacked?
by Claire Kelly 20 Aug '03

20 Aug '03

Sorry folks, my last message being sent to the list was my fault - this topic has long gone off-list. Again, apologies. Cheers, Cade

1 0

virus or hacked?
by Chris Todd 20 Aug '03

20 Aug '03

Good morning: I was wondering if anyone has seen this message on a win2k server before and might be able to help me Message from destroyer to you on 8/19/2003 11:24:53pm Make this your last pop-up ever Destroy all these pop-up for a fraction of the price of our competitors!!! go to www. messagdestroyer.net This is all in a plain windows box(gray box with an ok button at the bottom and the X is the upper right corner) Any help or insight would much appreciated!! Thanks Chris Todd Computer Technician Western Newspapers, Inc. (928)775-2499 Resistance is Futile

6 5

RE: virus or hacked?
by Claire Kelly 20 Aug '03

20 Aug '03

Yes, this is totally true. But my point was that being helpful is more efficient than pure cattiness (which could translate into arrogance *gasp*). Enough of that goes on on this list, and in any case, while we're busy sneering about our ignorant users, we could at least help out "our own". You know? Have a good one! Cheers, Cade -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Wednesday, August 20, 2003 2:03 PM To: Claire Kelly Cc: nanog(a)merit.edu Subject: Re: virus or hacked? On Wed, 20 Aug 2003 13:45:46 EDT, Claire Kelly <KellyC(a)ECONnergy.com> said: > How catty. We all start somewhere, or have you forgotten? You *do* have to admit it's an unusual combination of skills to: a) have enough clue to get subscribed to NANOG-post *AND* b) not be able to identify Windows Messenger spam....

1 0

RE: To send or not to send 'virus in email' notifications?
by Wesley Vaux 20 Aug '03

20 Aug '03

Has anyone else gotten hit by this and know how to stop it? the new dats from McAffee have not effect....of course...and I can't find a tool anywhere. Does anyone have any ideas? Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Daniel Senie [mailto:dts@senie.com] Sent: Wednesday, August 20, 2003 12:37 PM To: nanog(a)merit.edu Subject: Re: To send or not to send 'virus in email' notifications? Notifications from virus scanners is backscatter, just the same as the backscatter generated by Smurf attacks. The virus scanners are contributory technology in the conduct of a denial of service attack in exactly the same way as having directed broadcasts enabled on your routers was (read RFC 2644 for the details). Please let's stop building technology that aids in the conduct of DoS attacks.

1 0

Re: virus or hacked?
by Paul A. Bradford 20 Aug '03

20 Aug '03

That was my thought after my initial knee jerk how to fix response. I'm sorry for replying to the list.... Thanks, Paul -- Paul A Bradford Senior Network Engineer Adelphia Cable Communications 814-274-6663

1 0

RE: virus or hacked?
by Chris Todd 20 Aug '03

20 Aug '03

Ok, let me kill this now, To everyone that helped thank you very much.. to others I am sorry for posting off topic. I just now found out the server admin left the server outside the firewall with many open ports. again, thanks for all the help and sorry for the off topic spam. Chris Todd Computer Technician Western Newspapers, Inc. (928)775-2499 Resistance is Futile > ---------- > From: McBurnett, Jim > Sent: Wednesday, August 20, 2003 11:48 AM > To: Todd Mitchell - lists; Chris Todd > Cc: nanog(a)nanog.org > Subject: RE: virus or hacked? > > ->| -----Original Message----- > ->| From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > ->Of > ->| Chris Todd > ->| Sent: Wednesday, August 20, 2003 12:33 PM > ->| To: 'nanog(a)merit.edu' > ->| Subject: virus or hacked? > ->| > ->| > ->| Good morning: > ->| I was wondering if anyone has seen this message on a win2k server > ->before > ->| and > ->| might be able to help me > ->| > ->| Message from destroyer to you on 8/19/2003 11:24:53pm > ->| Make this your last pop-up ever Destroy all these pop-up for a > ->fraction of > ->| the price of our competitors!!! > ->| go to www. messagdestroyer.net > ->| > ->| This is all in a plain windows box(gray box with an ok button at the > ->| bottom > ->| and the X is the upper right corner) > ->| > -> > ->This is a standard Windows messenger (not MSN messenger) spam. If you > ->don't use the Windows messenger service, disable the "messenger" > ->service. SPAM will stop. > -> > ->Todd > > If you have this showing up on a server that is behind a firewall, you > may have a MUCH bigger problem. The access to the messenger service > requires access to a specific port, and this problem normally only > manifests > itslef when the server/workstation is plugged directly into an internet > pipe > with a real world IP on one of it's network cards!!!!! > > If you are not behind a firewall/router of even the linksys family, shame > on you. > If you are behind a firewall... Oh boy, better look for some security > problems!!!! > > later, > J > >

1 0

Re: Hey netscalibur! (was: Re: Hijacked email)
by Christopher Chin 20 Aug '03

20 Aug '03

Today at 18:38 (+0100), Dan Houghton wrote: > Date: Wed, 20 Aug 2003 18:38:43 +0100 > From: Dan Houghton <dan(a)houghton.org.uk> > To: Christopher Chin <cchin(a)ack.Berkeley.EDU> > Cc: nanog(a)merit.edu > Subject: Re: Hey netscalibur! (was: Re: Hijacked email) > > [. . .] > > IP in question is in use by a Netscalibur UK customer. The RIPE whois > record for the IP provides the abuse@ contact details (which is staffed and > dealt with correctly) but also noticed you emailed onto > noc(a)netscalibur.co.uk as well. > > I'll make sure that the NOC staff deal with it and get these stopped. Thanks for the quick response, Dan. It's great to hear that you have alert folks on the other end of both abuse@ and noc@ roles. As with most organizations, we have a fair amount of overlap between queries that arrive at abuse@, security@, and noc@, but we tend to handle operational issues via noc, and abuse@ is mostly for questionable behavior (intentional or otherwise) by our local users. With that in mind, I figured noc@netscalibur would be the more appropriate address. Please do let me know (offline is OK too) if that is not your preference. Thanks, - Christopher

1 0

IDT-Winstar
by Tony Varriale 20 Aug '03

20 Aug '03

Any of you know off the top of your head Winstar's config/policy for a customer wanting to accept customer routes only from a BGP feed? Or, a contact that can respond within a couple of hours would be useful too. I've called their NOC. They have no clue what I am talking about. They said email noc(a)winstar.net. Emailed them. No response...going on 2 days. Checked their website...about as useful as above. Thanks! Tony

1 0

RE: virus or hacked?
by McBurnett, Jim 20 Aug '03

20 Aug '03

->| -----Original Message----- ->| From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf ->Of ->| Chris Todd ->| Sent: Wednesday, August 20, 2003 12:33 PM ->| To: 'nanog(a)merit.edu' ->| Subject: virus or hacked? ->| ->| ->| Good morning: ->| I was wondering if anyone has seen this message on a win2k server ->before ->| and ->| might be able to help me ->| ->| Message from destroyer to you on 8/19/2003 11:24:53pm ->| Make this your last pop-up ever Destroy all these pop-up for a ->fraction of ->| the price of our competitors!!! ->| go to www. messagdestroyer.net ->| ->| This is all in a plain windows box(gray box with an ok button at the ->| bottom ->| and the X is the upper right corner) ->| -> ->This is a standard Windows messenger (not MSN messenger) spam. If you ->don't use the Windows messenger service, disable the "messenger" ->service. SPAM will stop. -> ->Todd If you have this showing up on a server that is behind a firewall, you may have a MUCH bigger problem. The access to the messenger service requires access to a specific port, and this problem normally only manifests itslef when the server/workstation is plugged directly into an internet pipe with a real world IP on one of it's network cards!!!!! If you are not behind a firewall/router of even the linksys family, shame on you. If you are behind a firewall... Oh boy, better look for some security problems!!!! later, J

1 0