Lon Stowell

Approximately 9/19/03 15:30, Mike Romain uttered for posterity:

> Interesting, I just checked a couple, and they were ones selling
> antivirus software promising to detect and remove all the others we are
> getting flooded with.
>
> Hmmmmmmm....
>
> I just wonder if this isn't some marketing ploy......??????

No, those are worms. W32.Swen.A@mm which may also be flagged
as Worm.Automat.AHB by Norton. If you see .ini, .exe, or
.jpg files that are NOT being flagged, your virus software
is downlevel.

A small number of the mails are from virus scan engines that
are returning errors to you due to the original worm having
your email address as source.
>

Mike Romain

I have the Sept. 18th release from Norton via live update today...???

Mike

Lon Stowell wrote:
>
> Approximately 9/19/03 15:30, Mike Romain uttered for posterity:
>
> > Interesting, I just checked a couple, and they were ones selling
> > antivirus software promising to detect and remove all the others we are
> > getting flooded with.
> >
> > Hmmmmmmm....
> >
> > I just wonder if this isn't some marketing ploy......??????
>
> No, those are worms. W32.Swen.A@mm which may also be flagged
> as Worm.Automat.AHB by Norton. If you see .ini, .exe, or
> .jpg files that are NOT being flagged, your virus software
> is downlevel.
>
> A small number of the mails are from virus scan engines that
> are returning errors to you due to the original worm having
> your email address as source.
> >

Mike Romain

I have the Sept. 18th release from Norton via live update today...???

Mike

Lon Stowell wrote:
>
> Approximately 9/19/03 15:30, Mike Romain uttered for posterity:
>
> > Interesting, I just checked a couple, and they were ones selling
> > antivirus software promising to detect and remove all the others we are
> > getting flooded with.
> >
> > Hmmmmmmm....
> >
> > I just wonder if this isn't some marketing ploy......??????
>
> No, those are worms. W32.Swen.A@mm which may also be flagged
> as Worm.Automat.AHB by Norton. If you see .ini, .exe, or
> .jpg files that are NOT being flagged, your virus software
> is downlevel.
>
> A small number of the mails are from virus scan engines that
> are returning errors to you due to the original worm having
> your email address as source.
> >

Lon Stowell

As of late on the 18th, that live update did NOT have the
signature for the latest worm in it. Only the Intelligent
Updater. Symantec may have re-released it, as it looks
like the warning now has 18 sep as the live update date,
whereas late on the 18th it was still saying 24 Sep.

Basically if you are seeing .ini or .exe files as attachments
and Norton is not flagging them, you have the old version
which doesn't have the update. Check your logfiles, which
may show the worm as being quarantined either as worm.automat
or w32.swen. If you have neither of these, you are definitely
downlevel. [You can also check the dictionary, but that is a
pita.]

Approximately 9/19/03 16:09, Mike Romain uttered for posterity:

> I have the Sept. 18th release from Norton via live update today...???
>
> Mike
>
> Lon Stowell wrote:
>>
>> Approximately 9/19/03 15:30, Mike Romain uttered for posterity:
>>
>> > Interesting, I just checked a couple, and they were ones selling
>> > antivirus software promising to detect and remove all the others we are
>> > getting flooded with.
>> >
>> > Hmmmmmmm....
>> >
>> > I just wonder if this isn't some marketing ploy......??????
>>
>> No, those are worms. W32.Swen.A@mm which may also be flagged
>> as Worm.Automat.AHB by Norton. If you see .ini, .exe, or
>> .jpg files that are NOT being flagged, your virus software
>> is downlevel.
>>
>> A small number of the mails are from virus scan engines that
>> are returning errors to you due to the original worm having
>> your email address as source.
>> >

Lon Stowell

As of late on the 18th, that live update did NOT have the
signature for the latest worm in it. Only the Intelligent
Updater. Symantec may have re-released it, as it looks
like the warning now has 18 sep as the live update date,
whereas late on the 18th it was still saying 24 Sep.

Basically if you are seeing .ini or .exe files as attachments
and Norton is not flagging them, you have the old version
which doesn't have the update. Check your logfiles, which
may show the worm as being quarantined either as worm.automat
or w32.swen. If you have neither of these, you are definitely
downlevel. [You can also check the dictionary, but that is a
pita.]

Approximately 9/19/03 16:09, Mike Romain uttered for posterity:

> I have the Sept. 18th release from Norton via live update today...???
>
> Mike
>
> Lon Stowell wrote:
>>
>> Approximately 9/19/03 15:30, Mike Romain uttered for posterity:
>>
>> > Interesting, I just checked a couple, and they were ones selling
>> > antivirus software promising to detect and remove all the others we are
>> > getting flooded with.
>> >
>> > Hmmmmmmm....
>> >
>> > I just wonder if this isn't some marketing ploy......??????
>>
>> No, those are worms. W32.Swen.A@mm which may also be flagged
>> as Worm.Automat.AHB by Norton. If you see .ini, .exe, or
>> .jpg files that are NOT being flagged, your virus software
>> is downlevel.
>>
>> A small number of the mails are from virus scan engines that
>> are returning errors to you due to the original worm having
>> your email address as source.
>> >

Lon Stowell

Approximately 9/19/03 16:07, Mike Romain uttered for posterity:

> Lon Stowell wrote:
>>
>> Approximately 9/19/03 15:00, Richard Harris uttered for posterity:
>>
>> > I've been getting at least 170-200 each time I log on....
>> > Anyone know the cure?
>> > I have Norton Antivirus that's up to date and its not getting any virus's...
>>
>> If Norton is not flagging the worms in the attachments, it isn't
>> sufficiently up to date. The Intelligent Updater patch was only
>> released 18 sep and the Live Update was only scheduled to be
>> released on 24 Sep, although Symantec may have changed this
>> after upgrading the worm thread due to this high PITA factor.
>>
>> The cure would be to beat your ISP bloody senseless to run
>> all mail thru a viral scan appliance... they are very fast
>> and very cheap.
>
> I did the live update today and have the Sept 18th release.
>
> It still doesn't tag them....

Pretty much what I said. Use the Intelligent Updater version.
Filename 20030918-007-i32.exe. 4,123 bytes. Easy to
use and the next live update will take care of cleaning
it up.

Lon Stowell

Approximately 9/19/03 16:07, Mike Romain uttered for posterity:

> Lon Stowell wrote:
>>
>> Approximately 9/19/03 15:00, Richard Harris uttered for posterity:
>>
>> > I've been getting at least 170-200 each time I log on....
>> > Anyone know the cure?
>> > I have Norton Antivirus that's up to date and its not getting any virus's...
>>
>> If Norton is not flagging the worms in the attachments, it isn't
>> sufficiently up to date. The Intelligent Updater patch was only
>> released 18 sep and the Live Update was only scheduled to be
>> released on 24 Sep, although Symantec may have changed this
>> after upgrading the worm thread due to this high PITA factor.
>>
>> The cure would be to beat your ISP bloody senseless to run
>> all mail thru a viral scan appliance... they are very fast
>> and very cheap.
>
> I did the live update today and have the Sept 18th release.
>
> It still doesn't tag them....

Pretty much what I said. Use the Intelligent Updater version.
Filename 20030918-007-i32.exe. 4,123 bytes. Easy to
use and the next live update will take care of cleaning
it up.

Lon Stowell

Approximately 9/19/03 16:30, Lon Stowell uttered for posterity:

> Approximately 9/19/03 16:07, Mike Romain uttered for posterity:
>
>> Lon Stowell wrote:
>>>
>>> Approximately 9/19/03 15:00, Richard Harris uttered for posterity:
>>>
>>> > I've been getting at least 170-200 each time I log on....
>>> > Anyone know the cure?
>>> > I have Norton Antivirus that's up to date and its not getting any virus's...
>>>
>>> If Norton is not flagging the worms in the attachments, it isn't
>>> sufficiently up to date. The Intelligent Updater patch was only
>>> released 18 sep and the Live Update was only scheduled to be
>>> released on 24 Sep, although Symantec may have changed this
>>> after upgrading the worm thread due to this high PITA factor.
>>>
>>> The cure would be to beat your ISP bloody senseless to run
>>> all mail thru a viral scan appliance... they are very fast
>>> and very cheap.
>>
>> I did the live update today and have the Sept 18th release.
>>
>> It still doesn't tag them....
>
> Pretty much what I said. Use the Intelligent Updater version.
> Filename 20030918-007-i32.exe. 4,123 bytes. Easy to
> use and the next live update will take care of cleaning
> it up.
>

Ooops, forgot to mention that if the .exe file is 0 bytes,
don't worry about Norton not flagging it, the file has already
been munched by a junk filter or worm stopper somewhere along
the line. You only need to worry if the file is a coupla
K bytes and Norton isn't flagging it.

Lon Stowell

Approximately 9/19/03 16:30, Lon Stowell uttered for posterity:

> Approximately 9/19/03 16:07, Mike Romain uttered for posterity:
>
>> Lon Stowell wrote:
>>>
>>> Approximately 9/19/03 15:00, Richard Harris uttered for posterity:
>>>
>>> > I've been getting at least 170-200 each time I log on....
>>> > Anyone know the cure?
>>> > I have Norton Antivirus that's up to date and its not getting any virus's...
>>>
>>> If Norton is not flagging the worms in the attachments, it isn't
>>> sufficiently up to date. The Intelligent Updater patch was only
>>> released 18 sep and the Live Update was only scheduled to be
>>> released on 24 Sep, although Symantec may have changed this
>>> after upgrading the worm thread due to this high PITA factor.
>>>
>>> The cure would be to beat your ISP bloody senseless to run
>>> all mail thru a viral scan appliance... they are very fast
>>> and very cheap.
>>
>> I did the live update today and have the Sept 18th release.
>>
>> It still doesn't tag them....
>
> Pretty much what I said. Use the Intelligent Updater version.
> Filename 20030918-007-i32.exe. 4,123 bytes. Easy to
> use and the next live update will take care of cleaning
> it up.
>

Ooops, forgot to mention that if the .exe file is 0 bytes,
don't worry about Norton not flagging it, the file has already
been munched by a junk filter or worm stopper somewhere along
the line. You only need to worry if the file is a coupla
K bytes and Norton isn't flagging it.

Carlo Jr.

Whoa..........I am sort of glad to hear that it is not only me. I get around
15 to 30 every time I open Outlook Express - even if it is only an hour or
so apart. You don't think that someone from this news group was less than
honorable, do you???????

--
Carlo F. Serusa, Jr. RPh
carlo.jr@comcast.net
'98 Sahara TJ - '89 YJ - '79 Scout II
O|||||||O
'92 Explorer '65 Mustang


"Kimball" <Somewhere@else.com> wrote in message
news:3F6B61FA.994A9B9B@else.com...
> d.edmondson@sbcglobal.net wrote:
> >
> > Ha! I got 19 of those e-mails today, so far. Someone is trying hard to
> > infect us. They are --------- ********!
> >
> > Dave
> >
> > "L.W. (ßill) ------ III" <----------@***.net> wrote in message
> > news:3F6B36B8.E78A9950@***.net...
> > > And of course don't take these free programs:
> > > http://www.----------.com/inbox.jpg
> > > God Bless America, ßill O|||||||O
> > > mailto:--------------------
> > >
>
> Life is so much easier here with WIN 95 and Nescape 4.7...
> Those virii just can' seem to get going anymore :)
>
> "The best defense is being obsolete!" Me, 2003.