hi,
sorry, I was infected by this f****ing worm, seemed to be FunLove, signature is :
1002sono: fsav (linux) virus (11828-54)
the scanning of my hard drive cleaned the following files :
c:\Windows\virscana.exe c:\1002sono c:\1017hist c:\1020hist
Check if you've got them.
I will check a virus site to know more about it.
cheers,
Yves/
hi again,
I'm not too sure about virus identification because my anti-virus is quite old but I'm sure about the files removed.
Maybe, it's a new worm.
If it's "Magic Lantern", we're only spied by the F.B.I. !!!
cheers,
Yves/
PS : is there a "Bin Laden" virus already ??? I'm surprised it didn't appeared yet. ----- Original Message ----- From: Yves Degoyon To: pd-list@iem.kug.ac.at Sent: Wednesday, November 28, 2001 12:52 PM Subject: [PD] What I know about this f****ing worm
hi,
sorry, I was infected by this f****ing worm, seemed to be FunLove, signature is :
1002sono: fsav (linux) virus (11828-54)
the scanning of my hard drive cleaned the following files :
c:\Windows\virscana.exe c:\1002sono c:\1017hist c:\1020hist
Check if you've got them.
I will check a virus site to know more about it.
cheers,
Yves/
hi yves, hi list,
sorry for that small off-topic posting. yes. there is a new worm on its way, my server already struggled from that in the past two days. i for myself will block any outlook mails in the future on my server. _before_ they are transfered, to save bandwidth. (simply checking the header for "Outlook" and "X-MSMail") maybe the listadmin here has a similar intention ?? if so, feel free to contact me about that. its a crude and draconian method, i know, but hey, there are tons of other mailers for win out there, that doesnt spread worms and virii. and upgrading a mail server to scan all mails comming in means spending huge amount of $$$ just because of crappy software out there. this cant be the solution. i tried it, and my experience say, that you need at least 4 times the cpu and ram power as normal if you want to scan all mails. (you have to load and run the antivir-proggy for _each_ mail, and imagine there are suddenly 100 mails at once ... so you need to load the av soft 100 times, too !)
greets,
chris
Am Mittwoch, 28. November 2001 12:52 schrieb Yves Degoyon:
hi,
sorry, I was infected by this f****ing worm, seemed to be FunLove, signature is :
1002sono: fsav (linux) virus (11828-54)
the scanning of my hard drive cleaned the following files :
c:\Windows\virscana.exe c:\1002sono c:\1017hist c:\1020hist
Check if you've got them.
I will check a virus site to know more about it.
cheers,
Yves/
Content-Type: text/html; charset="iso-8859-1"; name="Anhang: 1" Content-Transfer-Encoding: quoted-printable Content-Description:
hallo christian,
ich ueberlege gerade einen virenfilter in die pd liste einzubauen - ich denke an f-prot und amavis fuer den exim mta.
womit has du deine (offenbar schlechten?) erfahrungen gemacht?
ich dachte ich setz den filter ausschliesslich fuer die pd mailing liste ein und lasse die eingehenden mails scannen bevor sie verteilt werden.
also ca. 10 - 20 mails am tag, das sollte der rechner schaffen. (mehr kostet allerdings mein arbeitsaufwand)
das ganze macht zwar fuer die outlook luser das leben nicht sicherer aber wenigstens kommen dann keine ungewollten mails ueber die liste.
norbert
...
On Wed, 28 Nov 2001, Christian Klippel wrote:
hi yves, hi list,
sorry for that small off-topic posting. yes. there is a new worm on its way, my server already struggled from that in the past two days. i for myself will block any outlook mails in the future on my server. _before_ they are transfered, to save bandwidth. (simply checking the header for "Outlook" and "X-MSMail") maybe the listadmin here has a similar intention ?? if so, feel free to contact me about that. its a crude and draconian method, i know, but hey, there are tons of other mailers for win out there, that doesnt spread worms and virii. and upgrading a mail server to scan all mails comming in means spending huge amount of $$$ just because of crappy software out there. this cant be the solution. i tried it, and my experience say, that you need at least 4 times the cpu and ram power as normal if you want to scan all mails. (you have to load and run the antivir-proggy for _each_ mail, and imagine there are suddenly 100 mails at once ... so you need to load the av soft 100 times, too !)
greets,
chris
Hi,
actually, the files 1002sono, 1017hist etc are outputs of framestein, not a virus. You can change where these temporary files are being written to by modifying fs.sonogram.pd and fs.hist.pd. Sorry for bad behavior / lack of cleanup. I added a notification for 0.24.
On second thought, it's possible the virus did infect these files. In any case, just delete them.
juha
----- Original Message ----- From: Yves Degoyon To: pd-list@iem.kug.ac.at Sent: Wednesday, November 28, 2001 1:52 PM Subject: [PD] What I know about this f****ing worm
hi,
sorry, I was infected by this f****ing worm, seemed to be FunLove, signature is :
1002sono: fsav (linux) virus (11828-54)
the scanning of my hard drive cleaned the following files :
c:\Windows\virscana.exe c:\1002sono c:\1017hist c:\1020hist
Check if you've got them.
I will check a virus site to know more about it.
cheers,
Yves/
yes, i'm sorry about the confusion, my system was a mess ans was also infected by FunLove.
The real worm posted to this list was BTransB.
sorry again,
Yves/
----- Original Message ----- From: "Juha Vehviläinen" jusukoti@atp.fi To: "Yves Degoyon" ydegoyon@free.fr Cc: pd-list@iem.kug.ac.at Sent: Thursday, November 29, 2001 12:29 PM Subject: Re: [PD] What I know about this f****ing worm
Hi,
actually, the files 1002sono, 1017hist etc are outputs of framestein, not a virus. You can change where these temporary files are being written to by modifying fs.sonogram.pd and fs.hist.pd. Sorry for bad behavior / lack of cleanup. I added a notification for 0.24.
On second thought, it's possible the virus did infect these files. In any case, just delete them.
juha
----- Original Message ----- From: Yves Degoyon To: pd-list@iem.kug.ac.at Sent: Wednesday, November 28, 2001 1:52 PM Subject: [PD] What I know about this f****ing worm
hi,
sorry, I was infected by this f****ing worm, seemed to be FunLove, signature is :
1002sono: fsav (linux) virus (11828-54)
the scanning of my hard drive cleaned the following files :
c:\Windows\virscana.exe c:\1002sono c:\1017hist c:\1020hist
Check if you've got them.
I will check a virus site to know more about it.
cheers,
Yves/
-
Christian Klippel -
Juha Vehviläinen -
Norbert Math -
Yves Degoyon