email virus?
 

hey folks,
might be a virus goin around....
within 20 minutes i got 2 emails...
one from a chris.monner@maxpasley.com , which i dont recognize...
and one from newsletter@jlaquatics.com , both with attachements of 22.5kb in size... named body.pif and text.cmd respectively.
oh yeah, they were both sent to my email that i use for reef stuff, boards etc.

anyone else seeing this?

FWIW, the body of the email is all jibberish... and of course i didnt open the attachment, so i cant tell you whats in that!

I have not gotten any emails from J&L with viruses.. not yet anyways.. I'd give em a call and have them do a virus check.. sounds like they maybe infected?

:confused:

I got 2 tonight for my reefs address as well, one from acryliccity.com, the other from a stranger.

Watch out.

some people have gotten an emai from me, including myself, even thought I do not have their emails on my system. I have full uptodate virus protection, but this virus was just posted today, so I am doing a scan at the moment.

http://us.mcafee.com/virusInfo/default.asp?id=mydoom

i had it come in from two places one was from EmilyB and the other was some one i did not recognize on yahoo. the subject was HI and it was a .Scr file.


Seems to be hitting alot of people globaly

I've had a few trying to forward themselves off of my mail server. I'm checking all my machines now. Such fun....

Yup I got nailed with them from two of my own email accounts and they self opened somehow. The virus is
MIMAIL.R and the subject line was either test, status or Rfdqas. Unfortunatly I had pc cillen disabled at the time :frown: had system resouces freed up for video games. Didn't take long to get rid of them though.

I use Linux ELM to read mail so I don't ever get viruses. Deb, is your McAfee configure to scan Email in addition to your system? If only set to scan the System, then viruses won't get detected until you open your email. Then its too late.

hahhah...just got 2 more...one minute after eachother...
test.zip and ppqq.zip subjects...test, error, hi.
again only to my reef related email address.

yes, I've checked with my address book people and they haven't had anything, only reef people. :confused:

Yes Sam, it is set to scan email. :biggrin:

When I opened my email, it had identified the one sent to me.

I got it too, called shimgapi.dll, I have Mcaffee scans e-mail & system, I did a system virus scan & it deleted 3 but could not delete the one above.

It resides in my C/windows/system 32, how do I get rid of it, it won't allow me to delete it?

My office here got a couple.. but so far nothing on my home email.

Follow the instructions in this link

http://securityresponse.symantec.com...varg.a@mm.html

Ah crap. It apears that someone has been able to hijack my Linux mail server and send emails to people and make it appear to be coming from me.

That sucks.. tho I thought this virus could not infect the linux OS? A different virus?

Oops. Scratch that. It isn't doing what I thought it was doing. It turns out that I have added some procmail rules on my Linux account to filter Email with program attachments.

:lol:

So whenever someone with an infected computer tries to send me an Email with an attachment, I send a message back telling them that I don't accept program attachments. So no one has hijacked me. :lol: I had thought that because I started getting copies of empty messages with the email address of the person who tried to send me the virus. So I thought someone was hijacking my computer to send outbound Email. Not the case.

But I do know who has the infected computer trying to infect me though.

You did notify them, right?

It's not me :lol:

Apparently someone else had your email address on their system, and now the worm is spoofing your address as the "from".

From the Symantec site:
So even though your updated antivirus software may have caught them all, Deb (as mine seems to have), you may still get msgs back from "Mailer-Daemon" and "Mail Subsystem" at other ISPs because they are sending it back to you. Don't sweat it, you're likely fine.

Kind of freaky though... "Hey, I didn't send that! Did I??..."

Right. The from feild is spoofed, therefore it gets sent back to you. I've gotten so many back it isn't funny anymore. The headers indicated the source IP of some, so I did send a PM to that person.
Even though your system is clean, you can still get these non delivery reports.

I am getting them regularly. One said it came from dhadford. Deb says her machine is not guilty, and I will of course believe that, simply because we do not exchange emails. Hell we don't even talk :eek: One arrived a half hour ago, and norton simply deletes them, and notifies me.

Well, if it is on my machine, and a scan says it is not....then try not to take it personally..........okay :lol:

Yup. That was the case here. I thought the Email I got was from you but the IP address revealed where it actually came from which wasn't you.

I think he should be working on this as we speak.

It will be interesting to see who the DOS attack will be targetting come the first of next month...

"Attempts to perform a DoS attack against www.sco.com by creating 64 threads that send GET requests and use a direct connection to port 80."

Thanks a lot Brad, its finally gone :exclaim:
Hope it didn't infect or affect any of you guys, I had no idea I had it until Brad helped out :biggrin:

Figures it was a SouthPark guy..... :lol: :razz:

Someone in Calgary is still infected. Please check your systems and make sure you have the latest virus definitions. If you think you may have it and aren't sure what to do, PM me for assistance.

OK, can the person with IP 68.144.223.33 please clean the stupid virus off their computer? Thanks!!

I finaly got this virus in my e-mail at work.. I'm so blessed.. :biggrin: .. still nothing at home tho..

Someone on Shaw... that's all I know...

h68-144-223-33.cg.shawcable.net

http://whatismyip.com/

Just in case you dont know how to check your IP =)

In the Calgary area.

Thanks.

This is a most anoying virrus. i thought i cleard it out, but it created a back door. stupid stupid me.....

I read that if you want to protect your mail box from sending out viruses to enter the address aaaaa@aaa.com it will be the first address that is delievered too and it will fail therefore the group email will not go through.... not sure if it really works or not but I've got it and no one's ever gotten a virus from me.

Doug

I've never heard of that one? Hmm, have to look around on that..

Just got an email from joe@whitefuzzymonkey.com (among dozens of others) :razz:

Hey Kris, is that your website? wicked stuff :cool: