🚀 go-pugleaf

The problem with this worm is that it is a DoS attack on lots of mailservers
I have had about 2000 of these in the last 2 days - I wonder if it is those
who are using NGs - a lot of the frequent posters on this NG are affected.
I have talked to my ISP - the worm avoids most of their filter settings. It
appears to disguise its source address. This will be one of the biggest
attacks yet I think. It doesnt matter which E mail clent you use as the worm
clogs up your mailbox at the ISP level.

Richard



Spehro Pefhany <speff@interlog.com> wrote in message
news:6qommvk7uajvg9t295na295c2d3rbh3ns0@4ax.com...
> On Fri, 19 Sep 2003 12:47:34 -0700, the renowned John Larkin
> <jjlarkin@highSNIPlandTHIStechPLEASEnology.com> wrote:
>
> >On Fri, 19 Sep 2003 12:22:00 -0700, Jim Thompson
> ><Jim-T@golana-will-get-you.com> wrote:
> >
> >>On 19 Sep 2003 12:02:11 -0700, Winfield Hill <whill@picovolt.com>
> >>wrote:
> >>
> >>>Don Pearce wrote...
> >>>>
> >>>> On 19 Sep 2003 10:51:14 -0700, Aubrey >McIntosh wrote:
> >>>>
> >>>>> I have received almost 700 copies of worm or virus mail
> >>>>> to this account [snipped] in the past 24 hours.
> >>>>>
> >>>>> This has been the GIBE virus, the new "returned mail" item.
> >>>>>
> >>>>> Anyone else?
> >>>>
> >>>> Everyone. At 700 you have come off lightly.
> >>>
> >>> I got over 1000 at home this morning, over 450 of them
> >>> arriving in a single 5 minute period at about 0640 EST.
> >>> Strangely, I got almost none at my work email.
> >>>
> >>> Thanks,
> >>>    - Win
> >>
> >>Those of us running Eudora got NONE ;-)
> >>
> >>                                        ...Jim Thompson
> >
> >Netscape, none, but I don't see how one's email client affects this.
> >At least with Netscape, unopened mail doesn't execute.
> >
> >What do the virus messages look like?
>
> http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html
>
> A lot of them look like the "Microsoft" message that starts about
> halfway down the above page. Or a fake bounced e-mail message.
>
> I've gotten about 1500 of them (at 140K+ each) in the last 30 hours.
> 8-(   Of course I'm not about to execute an unknown file, but it's
> clogging things up like a mailbomb attack- and some incoming mails got
> bounced overnight.
>
> Best regards,
> Spehro Pefhany
> --
> "it's the network..."                          "The Journey is the reward"
> speff@interlog.com             Info for manufacturers:
http://www.trexon.com
> Embedded software/hardware/analog  Info for designers:
http://www.speff.com