- NANOG - lists.nanog.org

Re: virus or hacked?
by Gregory Hicks 20 Aug '03

20 Aug '03

> From: Chris Todd <ctodd(a)westernnews.com> > Date: Wed, 20 Aug 2003 09:32:30 -0700 > > > Good morning: > I was wondering if anyone has seen this message on a win2k server > before and might be able to help me Chris: This is the new spam technique using the windows "admin" pop-up vector. Supposed to be used by an Admin to send messages of some import to all their users on a particular server. That the popup showed up means you have some patching to do as well as some (3 - I think) ports to block on your firewall. See the NANOG archives for more details. Regards, Gregory Hicks > > Message from destroyer to you on 8/19/2003 11:24:53pm > Make this your last pop-up ever Destroy all these pop-up for a fraction of > the price of our competitors!!! > go to www. messagdestroyer.net > > This is all in a plain windows box(gray box with an ok button at the bottom > and the X is the upper right corner) > > Any help or insight would much appreciated!! > > Thanks > Chris Todd > Computer Technician > Western Newspapers, Inc. > (928)775-2499 > > Resistance is Futile --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

Re: To send or not to send 'virus in email' notifications?
by Leo Bicknell 20 Aug '03

20 Aug '03

FWIW In a message written on Wed, Aug 20, 2003 at 10:04:05AM -0700, Steve Thomas wrote: > From: Steve Thomas <nanog(a)sthomas.net> > To: Leo Bicknell <bicknell(a)ufp.org> > Subject: Re: To send or not to send 'virus in email' notifications? [other headers editied] > NO! Some organizations (the company I work for, for instance) use MailScanner on incoming AND outgoing mail. I tried telling this to the person who sent the Postfix regex, but, of course, my mail was rejected. > > MailScanner is a very widely used product, and adding rules/filters like the one above only adds to the problems that the virus author is trying to create. Please forward this to NANOG - I tried subscribing to NANOG-POST, but my subscription request was bounced with "content rejected". Note, unlike the postfix rule his message still made it past spamassassin has he had enough "non-spam" qualities to offset the rule I suggested adding. Please keep in mind there may be legitimate e-mail with these headers if you're going to use rules such have been suggested here. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

RE: To send or not to send 'virus in email' notifications?
by Claire Kelly 20 Aug '03

20 Aug '03

http://support.microsoft.com/default.aspx?scid=kb;[LN];823980 Cheers, Cade Kelly System/Network Administrator ECONnergy Co. Inc Spring Valley, NY -----Original Message----- From: Wesley Vaux [mailto:Wesley.Vaux@globalknowledge.com] Sent: Wednesday, August 20, 2003 11:58 AM To: 'Stephen J. Wilcox'; Joe Maimon Cc: nanog(a)merit.edu Subject: RE: To send or not to send 'virus in email' notifications? At 10:30:43 my systems rebooted after installing hotfix "Windows 2000 Hotfix KB823980 was installed" and machines rebooted. Any ideas on how to remove this or what it may be? Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] Sent: Wednesday, August 20, 2003 10:33 AM To: Joe Maimon Cc: nanog(a)merit.edu Subject: Re: To send or not to send 'virus in email' notifications? On Wed, 20 Aug 2003, Joe Maimon wrote: > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? well if you dont tell them they wont know, altho with sobig the return address is false anyhow it would probably be best to cache the sender/virus combinations and send a single message per 7 days Steve

1 0

RE: To send or not to send 'virus in email' notifications?
by Wesley Vaux 20 Aug '03

20 Aug '03

At 10:30:43 my systems rebooted after installing hotfix "Windows 2000 Hotfix KB823980 was installed" and machines rebooted. Any ideas on how to remove this or what it may be? Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] Sent: Wednesday, August 20, 2003 10:33 AM To: Joe Maimon Cc: nanog(a)merit.edu Subject: Re: To send or not to send 'virus in email' notifications? On Wed, 20 Aug 2003, Joe Maimon wrote: > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? well if you dont tell them they wont know, altho with sobig the return address is false anyhow it would probably be best to cache the sender/virus combinations and send a single message per 7 days Steve

2 1

RE: To send or not to send 'virus in email' notifications?
by Brandon Butterworth 20 Aug '03

20 Aug '03

> > Considering the amount of email traffic generated by responding to > > forged virus laden email from culprits like sobig should email virus > > scanning systems be configured to send notifications back to > > sender or not? If your scanner doesn't know if a virus forges addresses, and hence no point replying, then bin it and buy a proper one brandon

1 0

RE: To send or not to send 'virus in email' notifications?
by Tomas Daniska 20 Aug '03

20 Aug '03

maybe the AV vendors could suply a 'to mail or not to mail' flag within their databases, based on character of the virus... any of them lurking here? :) -- deejay > -----Original Message----- > From: Matthew Kaufman [mailto:matthew@eeph.com] > Sent: 20. augusta 2003 16:41 > To: 'Joe Maimon'; nanog(a)merit.edu > Subject: RE: To send or not to send 'virus in email' notifications? > > > > Absolutely not. > > SoBig.F, like many others, forges the sender address. That > means that your > notifications: > 1) Don't make it back to the person with the infection > 2) Simply add more clutter to the mailbox of the person > whose address was > used (in addition to all the bounce messages) > > In the enterprise, this is a great argument for scanning > outbound email with > positive identification of whose outbound mail you're scanning. > > Matthew Kaufman > matthew(a)eeph.com > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > Behalf Of Joe Maimon > > Sent: Wednesday, August 20, 2003 7:25 AM > > To: nanog(a)merit.edu > > Subject: To send or not to send 'virus in email' notifications? > > > > > > > > Considering the amount of email traffic generated by responding to > > forged virus laden email from culprits like sobig should > email virus > > scanning systems be configured to send notifications back to > > sender or not? > > > > > > > > > >

2 1

RE: To send or not to send 'virus in email' notifications?
by Mark Segal 20 Aug '03

20 Aug '03

All of "my" bounces are coming from emails that originated from 195.157.87.253... Maybe it's the same guy with others here? Mark Fyi.. netadmin@aaa-01:~> whois -h whois.ripe.net 195.157.87.253 % This is the RIPE Whois server. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/ripencc/pub-services/db/copyright.html inetnum: 195.157.70.0 - 195.157.87.255 netname: NSUK-PARTITION-LL descr: Connectivity country: GB admin-c: NSUK2-RIPE tech-c: NSUK1-RIPE status: LIR-PARTITIONED PA remarks: ************************************************************** remarks: * Please do not send abuse reports to tech or admin contacts * remarks: * All abuse reports to abuse(a)netscalibur.co.uk * remarks: ************************************************************** remarks: * This is an partition object and does not represent a valid # remarks: # assignment. Valid assignments have status: ASSIGNED PA # remarks: ############################################################## notify: ripe(a)netscalibur.co.uk mnt-by: NETSCALIBURUK-MNT mnt-lower: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20011025 changed: ripe(a)netscalibur.co.uk 20020110 changed: ripe(a)netscalibur.co.uk 20020514 source: RIPE route: 195.157.0.0/16 descr: Netscalibur UK Ltd origin: AS8272 mnt-by: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20010706 source: RIPE role: Netscalibur UK Hostmaster address: Netscalibur UK Ltd address: 9 Selsdon Way address: Cityharbour address: London E14 9GL address: UK phone: +44 (0)870 887 8800 fax-no: +44 (0)870 887 8867 e-mail: hostmaster(a)netscalibur.co.uk admin-c: CSP3-RIPE admin-c: SY131-RIPE tech-c: NSUK1-RIPE tech-c: NSUK3-RIPE nic-hdl: NSUK2-RIPE remarks: Hostmaster remarks: **** remarks: * All abuse reports to abuse(a)netscalibur.co.uk remarks: **** notify: ripe(a)netscalibur.co.uk mnt-by: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20010712 changed: ripe(a)netscalibur.co.uk 20010731 changed: ripe(a)netscalibur.co.uk 20020109 changed: ripe(a)netscalibur.co.uk 20020116 source: RIPE role: Netscalibur UK NOC address: Netscalibur UK Ltd address: 9 Selsdon Way address: Cityharbour address: London E14 9GL address: UK phone: +44 (0)845 117 2200 fax-no: +44 (0)870 887 8867 e-mail: noc(a)netscalibur.co.uk admin-c: ZP64-RIPE admin-c: DJH8-RIPE tech-c: NSUK2-RIPE tech-c: NSUK3-RIPE nic-hdl: NSUK1-RIPE remarks: Network Operations Center remarks: **** remarks: * All abuse reports to abuse(a)netscalibur.co.uk remarks: **** notify: ripe(a)netscalibur.co.uk mnt-by: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20010711 changed: ripe(a)netscalibur.co.uk 20020116 source: RIPE -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Jim Deleskie [mailto:jdeleski@rci.rogers.com] Sent: August 20, 2003 10:36 AM To: nanog(a)merit.edu Subject: RE: To send or not to send 'virus in email' notifications? Kind of like a statement made @ a security conference I was recently at, 'Hacking from the conference = Dismissal, if you have to ask No you shouldn't' -----Original Message----- From: Gregory Hicks [mailto:ghicks@cadence.com] Sent: Wednesday, August 20, 2003 10:30 AM To: nanog(a)merit.edu; jmaimon(a)ttec.com Subject: Re: To send or not to send 'virus in email' notifications? > Date: Wed, 20 Aug 2003 10:25:28 -0400 > From: Joe Maimon <jmaimon(a)ttec.com> > To: nanog(a)merit.edu > Subject: To send or not to send 'virus in email' notifications? > > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? Not.

1 0

RE: To send or not to send 'virus in email' notifications?
by Jim Deleskie 20 Aug '03

20 Aug '03

Kind of like a statement made @ a security conference I was recently at, 'Hacking from the conference = Dismissal, if you have to ask No you shouldn't' -----Original Message----- From: Gregory Hicks [mailto:ghicks@cadence.com] Sent: Wednesday, August 20, 2003 10:30 AM To: nanog(a)merit.edu; jmaimon(a)ttec.com Subject: Re: To send or not to send 'virus in email' notifications? > Date: Wed, 20 Aug 2003 10:25:28 -0400 > From: Joe Maimon <jmaimon(a)ttec.com> > To: nanog(a)merit.edu > Subject: To send or not to send 'virus in email' notifications? > > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? Not.

1 0

Re: To send or not to send 'virus in email' notifications?
by Gregory Hicks 20 Aug '03

20 Aug '03

> Date: Wed, 20 Aug 2003 10:25:28 -0400 > From: Joe Maimon <jmaimon(a)ttec.com> > To: nanog(a)merit.edu > Subject: To send or not to send 'virus in email' notifications? > > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? Not.

1 0

RE: AT&T US Network Slowdown?
by Sean Crandall 19 Aug '03

19 Aug '03

> > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T > network since 8/18 at around 4pm which is causing a lot of > internet circuits (including DSL) to be inaccessible and/or > appear down from the outside world? AT&T says this has been > escalated to "Level 4" with no ETA and affecting the whole > country. I am seeing this problem in the San Francisco area. > Just wondering if anyone else is experiencing anything that > would confirm AT&T's claim, and fishing for more info about > the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

6 5