I have received an e-mail from someone claiming to be MarkG, containing a virus - Page 2

Rasbelin · September 28, 2003, 09:08

Don't worry, I did get the address. I just subscribed you to several *cough* adult entertainment newsletters *cough* and horny goat weed bulletins.

Could you please put it back because I think I missed it?

Panag · September 28, 2003, 13:14

hi ,

www.finjan.com , then it cant open itself

and what kind of an isp lets a virus true , .......

have a nice day

FrustratedPoet · September 29, 2003, 04:36

Quote:

Originally posted by Nuclear Master
When I am in my Apolyton e-mail I recieve countless e-mails from admin@apolyton.net that contain viruses.

So do I.

rah · September 29, 2003, 10:17

They're called Ming warning e-mails. Failure to respond usually results in bannings. So I highly recommend that you all open them.

FrustratedPoet · September 29, 2003, 10:44

"Read, Respond and be Infected"?

Tassadar500 · September 29, 2003, 10:55

Shame on you, Rah

Az · September 29, 2003, 11:15

Damn staff club thread.

DrSpike · September 29, 2003, 11:59

The all new Mingapulco: Not only is it not a fun stay, you also come back home infected with a variety of tropical diseases.

rah · September 29, 2003, 15:16

Well it's obvious, that some people just can't take a joke.

I even used the infamous

Frozzy · September 29, 2003, 18:26

Quote:

Originally posted by rah
They're called Ming warning e-mails. Failure to respond usually results in bannings. So I highly recommend that you all open them.

Yeah right

Verto · September 29, 2003, 19:51

Quote:

Originally posted by geeslaka
Building an arsenal Tass? Be warned, viruses may be declared weapons of mass destruction....

Interesting idea...

Asmodean · September 30, 2003, 01:53

Quote:

Originally posted by rah
Well it's obvious, that some people just can't take a joke.

I even used the infamous

Perhaps they were afraid to join in the fun, for fear of experiencing some rah math

Asmodean

Dis · September 30, 2003, 03:05

if you don't actually download the attachment you don't need norton anti-virus do you? You can't have viruses from just regular e-mails can you?

I'm still too cheap to pay money for norton anti-virus

DrSpike · September 30, 2003, 06:01

There are online scanners you can use if you are stuck. Not opening dodgy attachments is a good start.............it is not, however, a guarantee.

Asmodean · September 30, 2003, 06:02

Some attachments are programmed to open themselves, once the e-mail in question is viewed. A thing that frankly pissed me off

Asmodean

rah · September 30, 2003, 09:51

Quote:

Originally posted by Asmodean
Perhaps they were afraid to join in the fun, for fear of experiencing some rah math

Asmodean

Considering the axis of spam that posted after me.........
Frozzy
Asmodean
Dissident
DrSpike
I highly doubt it.

Hueij · September 30, 2003, 13:14

Quote:

Originally posted by Dissident
if you don't actually download the attachment you don't need norton anti-virus do you? You can't have viruses from just regular e-mails can you?

I'm still too cheap to pay money for norton anti-virus

Dis, here is agreat free anti-virus program: www.grisoft.com

Skanky Burns · September 30, 2003, 22:56

Quote:

Originally posted by Asmodean
Some attachments are programmed to open themselves, once the e-mail in question is viewed. A thing that frankly pissed me off

Asmodean

I avoid using any email software that does actually run any code contained in emails beyond html. The risk is too great, in my opinion.

Quote:

axis of spam

Is that like the axis of evil?
Anyway, it can't be a true axis of spam without at least one post by me.

Atahualpa · October 1, 2003, 05:52

Forget about the Return-Path entry. That can be faked so easily. Mailserver communication goes like this:

helo somename
-- mailserver response
mail from: any e-mail address here will show up as Return-Path
-- mailserver response (250 OK)
rcpt to: asmodean@***.dk
-- mailserver response (250 OK)
data
-- mailserver response
Subject: Bla
From: markg

Hello text text
.

As you see you can completely hide your email in such a communication. Apart from the rcpt to: you can enter bogus adresses.
The only thing that marks the sender is his ip adress in the first received entry (read from bottom to top)

So the mail appears to come from: 68.86.43.63
The do a WHOIS lookup to see who this ip belongs to either with arin.net (America) or ripe.net (Europe):
http://ws.arin.net/cgi-bin/whois.pl?queryinput=!%20NET-68-86-32-0-1
There you will find information where to send abuse reportings.

I have done this some times when I got very annoyed with spam and I got some responses from ISPs who said they've investigated and shut down the user. Whatever, now I just sort out 80-90% of the spam into a special folder on my imap server and mark them "read" so that they dont appear as new mail.

ata

Atahualpa · October 1, 2003, 05:58

Quote:

Originally posted by Skanky Burns
I avoid using any email software that does actually run any code contained in emails beyond html. The risk is too great, in my opinion.

In Outlook Express you can select to view every e-mail plain-text only. So no VBS/dangerous HTML code can be executed

(assuming OE's view plain-text only option is not exploitable)

I have also disabled the preview pane.

ata

rah · October 1, 2003, 08:25

Disabling the preview pane is highly recommended.
It's also a good idea to disable the automatic opening of the next message.

Rasbelin · October 1, 2003, 09:35

It's also recommended to use some better e-mail client like Eudora, Pegasus Mail, Netscape Mail, Mozilla Mail or Mozilla Thunderbird.

FrustratedPoet · October 1, 2003, 09:39

Quote:

Originally posted by rah
Disabling the preview pane is highly recommended.
It's also a good idea to disable the automatic opening of the next message.

Oh hell yeah!

rah · October 1, 2003, 09:44

Quote:

Originally posted by Asuka
It's also recommended to use some better e-mail client like Eudora, Pegasus Mail, Netscape Mail, Mozilla Mail or Mozilla Thunderbird.

At work, I don't get a choice.

At home, we use netscape.

Ben Kenobi · October 1, 2003, 10:42

Quote:

Is that like the axis of evil?
Anyway, it can't be a true axis of spam without at least one post by me.

Naw, you're just part of the Axis of semi-spam.

Urban Ranger · October 4, 2003, 07:30

Quote:

Originally posted by Atahualpa
Forget about the Return-Path entry. That can be faked so easily.

I thought newer versions of sendmail has plugged this hole?

Atahualpa · October 4, 2003, 08:02

Quote:

I thought newer versions of sendmail has plugged this hole?

This is no hole but part of the Simple Mail Transfer Protocol.

How should sendmail do a check on the "mail from:" address anyway?

All it can do is checking if the e-mail address given has correct syntax and that a valid domain is given. AFAIK this is done.
But well this doesnt help anything because I could use your e-mail address when sending mail and you'd be written in the Return-Path then. Its a valid e-mail address and it exists but there is no way to check if this e-mail address really belongs to me. You'd have to introduce a new email protocol where you have to use certification that the e-mail you are using is really yours. This would however rely on central certification storage servers and the whole thing would be quite vulnerable to DOS attacks and thelike.
AFAIK there is already development of a new protocol for e-mail, but I dont know anything specific.

I was once part of such an "attack" where some spammer put my e-mail address as "mail from: " and i got lots of failed delivery messages. This was EXTREMLY annoying!!

The only thing you can rely on is the IP. That would be a bit more difficult to fake. It is possible to fake the first received entries by using public ip addresses in a private lan and setup a router to do the routing. But eventually the mail has to leave the private network and the first mailserver that is not part of that network lists the real ip of the spammer.

ata

Panag · October 4, 2003, 12:38

Quote:

Originally posted by Asmodean
Some attachments are programmed to open themselves, once the e-mail in question is viewed. A thing that frankly pissed me off

Asmodean

hi ,

www.finjan.com , its like a supermax for your mail , ......

have a nice day

Asmodean · October 4, 2003, 14:07

I swear to God, the next time I see panag plug finjan.com, I will get a nervous breakdown.

panag: Message received, okay!!

Asmodean

DrSpike · October 4, 2003, 14:21

Just make sure you don't ask him for smileys.