net security. just a comment from your moderator

"bob mologna" wrote in message
...
I've been getting 500 - 600 o f these viri/day for the past few days. At
around 150k each the bandwidth alone would be cripling if I were on
dial-up
(many still are). I've set my mail server to reject the MS worm but if you
are on a dial-up you should download and install Mailwasher. It allows you
to preview and delete messages before you download them. It's free BTW.

"Peter W. Rowe" wrote in message
...
folks, this is a bit off topic, but perhaps not totally, if you're
jewelers
using the net...

Well, that's a stretch. But this may be important.

Just a heads-up notice to be VERY careful with your email.

Today I think my incoming email, on several account names, not all of
which are
widely published, was filled with many multiples of dangerous emails.
And
(snip)

The virus is called (SWEN) (NEWS) and the addresses are culled froom the
newsgroups. Can we prevent it in some way?

On Fri, 26 Sep 2003 02:10:57 GMT, in rec.crafts.jewelry Marion Margoshes
wrote:

The virus is called (SWEN) (NEWS) and the addresses are culled froom the
newsgroups. Can we prevent it in some way?

simply put, not much at this point (after the fact).

The worm (it's a worm, not a virus), spreads mostly by harvesting addresses it
can find on a computer it has successfully infected. It gets them by scanning
address booksin email programs of several types, especially those that use HTML
formatting.It also can scan any stored HTML files, and a number of other sources
on an infected computer looking for email addresses. AND, it can sign on to
newsgroups, via it's own internal list of news servers, not necessarily your
ISP, and scan the newsgroups there, for usable email addresses.

In short, this thing is VERY efficient at harvesting addresses from a wide
range of places, both email and news. as moderator, I block the copies of these
things that are sent to rec.crafts.jewelry, since the worm doesn't yet know how
to forge approval headers. But there's little you can do to stop how the worm
can search newsgroups, or the email address files of those computers it's
infected, other than to see to it that your own address, anywhere it's ever sent
out, is spam protected by munging it up. The worm specifically rejects email
addresses containing the words spam or delete...

Not much you can do after the fact, since once your email adress is out there in
past posts, or on other folks mail lists, if they're infected, then the worm
gets your address.

You can read a very complete (and quite interesting) account of what this thing
does and how, at the http://www.datafellows.com/v-descs/swen.shtml web site.

In terms of controlling your own incoming flood of these emails, you can do what
I'm doing, just waiting it out, since as folks discover the bug and remove it
and protect themselves from it, the attack will stop, or you can try and set up
email filters with your mail program. That's a lot of work, since this thing
uses many subject lines, randomly generated, and the "from" sender addresses are
also either random, or just from some infected computer, not any one single
source. A kill filter just based on words like microsoft and security update,
will get many of them, but might then also get legitimate messages too. Some
folks in the group like mailwasher. (see other replies in this thread) I've
not tried it.

Peter