From: owner-lucy-list-digest@smoe.org (lucy-list-digest) To: lucy-list-digest@smoe.org Subject: lucy-list-digest V5 #172 Reply-To: lucy-list@smoe.org Sender: owner-lucy-list-digest@smoe.org Errors-To: owner-lucy-list-digest@smoe.org Precedence: bulk lucy-list-digest Sunday, August 24 2003 Volume 05 : Number 172 In this issue: [lucy-list] Re: Your application [lucy-list] Re: Thank you! [lucy-list] Re: Re: My details [lucy-list] Re: Re: My details [lucy-list] Re: Re: My details [lucy-list] Re: Wicked screensaver [lucy-list] VIRUSES/ Virii Re: [lucy-list] VIRUSES/ Virii Re: [lucy-list] VIRUSES/ Virii Re: [lucy-list] VIRUSES/ Virii Re: [lucy-list] VIRUSES/ Virii Re: [lucy-list] VIRUSES/ Virii [lucy-list] Broken Strings...and unbelievable boredome Re: [lucy-list] Is there any way to know ... [lucy-list] Famous New Yorker, no longer non-driving ---------------------------------------------------------------------- Date: Sat, 23 Aug 2003 5:07:36 --0400 From: Subject: [lucy-list] Re: Your application See the attached file for details [demime 0.97c-p1 removed an attachment of type application/octet-stream which had a name of movie0045.pif] ------------------------------ Date: Sat, 23 Aug 2003 6:02:44 --0400 From: Subject: [lucy-list] Re: Thank you! See the attached file for details [demime 0.97c-p1 removed an attachment of type application/octet-stream which had a name of wicked_scr.scr] ------------------------------ Date: Sat, 23 Aug 2003 6:36:54 --0400 From: Subject: [lucy-list] Re: Re: My details See the attached file for details [demime 0.97c-p1 removed an attachment of type application/octet-stream which had a name of thank_you.pif] ------------------------------ Date: Sat, 23 Aug 2003 7:45:26 --0400 From: Subject: [lucy-list] Re: Re: My details Please see the attached file for details. [demime 0.97c-p1 removed an attachment of type application/octet-stream which had a name of document_all.pif] ------------------------------ Date: Sat, 23 Aug 2003 7:50:54 --0400 From: Subject: [lucy-list] Re: Re: My details See the attached file for details [demime 0.97c-p1 removed an attachment of type application/octet-stream which had a name of your_document.pif] ------------------------------ Date: Sat, 23 Aug 2003 8:06:58 --0400 From: Subject: [lucy-list] Re: Wicked screensaver Please see the attached file for details. [demime 0.97c-p1 removed an attachment of type application/octet-stream which had a name of wicked_scr.scr] ------------------------------ Date: Sat, 23 Aug 2003 09:13:46 -0400 From: Bill Stewart Subject: [lucy-list] VIRUSES/ Virii My sympathies for all those affected by the worm. Of course, if you either used netscape/mozilla, OR Switched to linux this would not affect you. Bill ------------------------------ Date: Sat, 23 Aug 2003 09:26:45 -0400 From: Tom Neff Subject: Re: [lucy-list] VIRUSES/ Virii - --On Saturday, August 23, 2003 9:13 AM -0400 Bill Stewart wrote: > My sympathies for all those affected by the worm. > > Of course, if you either used netscape/mozilla, > > OR > Switched to linux this would not affect you. Certainly it would, because even though uninfected, you would still be inundated with messages from others, and with responses from scanners and people worldwide who *think* they got it from you. Worms that fake the From: field leave nobody undisturbed. If your address is out there, you're a target. The best thing to do if your system allows it, for now, is to block by IP. Unlike the previous background level of virus chatter, this one seems to sit on an individual machine and BLAST everyone in the address book/mailspool repeatedly. I had 148 (out of 200 total) messages today from one IP - some poor Canadian victim. Yesterday it was a different IP. Just look in the headers. ------------------------------ Date: Sat, 23 Aug 2003 11:39:33 -0400 From: "Kristen Myshrall" Subject: Re: [lucy-list] VIRUSES/ Virii Yep unfortunately I use Mozilla and it doesn't stop the million of emails, some of which still look like they are coming from me.....and as for blocking the IP, that works great if you don't care or know who the person is, unfortunately most of the emails that I'm getting are from people I know or from people on the list who do occasionally post. I figure, I'm not going to get it...i know all the email titles...just grin and bear it and delete delete delete! The worm will run its course, of course we have to wait til Sept 10, but it will be gone by then. - -Kristen _________________________________________________________________ Get MSN 8 and help protect your children with advanced parental controls. http://join.msn.com/?page=features/parental ------------------------------ Date: Sat, 23 Aug 2003 10:52:30 -0700 From: "Gina" Subject: Re: [lucy-list] VIRUSES/ Virii I, like everyone else, have received a lot of these suspicious emails from the Lucy-list. Fortunately I have deleted them all before opening the attachments. Is there any way to get infected if you don't open the attachments? I ran a virus scan on my hard drive and there were no viruses detected. Is there any way to know if your email account is sending out viruses to people? My yahoo account sent me a msg. saying that they found one and it used my yahoo email address in the explanation of who it was from. If anyone knows, please share. Gina - ----- Original Message ----- From: "Tom Neff" To: Sent: Saturday, August 23, 2003 6:26 AM Subject: Re: [lucy-list] VIRUSES/ Virii > --On Saturday, August 23, 2003 9:13 AM -0400 Bill Stewart > wrote: > > > My sympathies for all those affected by the worm. > > > > Of course, if you either used netscape/mozilla, > > > > OR > > Switched to linux this would not affect you. > > Certainly it would, because even though uninfected, you would still be > inundated with messages from others, and with responses from scanners and > people worldwide who *think* they got it from you. Worms that fake the > From: field leave nobody undisturbed. If your address is out there, you're > a target. > > The best thing to do if your system allows it, for now, is to block by IP. > Unlike the previous background level of virus chatter, this one seems to > sit on an individual machine and BLAST everyone in the address > book/mailspool repeatedly. I had 148 (out of 200 total) messages today > from one IP - some poor Canadian victim. Yesterday it was a different IP. > Just look in the headers. ------------------------------ Date: Sat, 23 Aug 2003 13:58:36 -0400 From: Tom Neff Subject: Re: [lucy-list] VIRUSES/ Virii - --On Saturday, August 23, 2003 11:39 AM -0400 Kristen Myshrall wrote: > Yep unfortunately I use Mozilla and it doesn't stop the million of > emails, some of which still look like they are coming from me.....and as > for blocking the IP, that works great if you don't care or know who the > person is, unfortunately most of the emails that I'm getting are from > people I know or from people on the list who do occasionally post. Actually they're not FROM those people - those people's names were faked into the From: field in the message headers. They're really FROM somebody else - somebody who doesn't even know their PC is sending thousands of fake emails. Somebody like - ---------- Received: from RWDESKTOP (ool-4353bb44.dyn.optonline.net [67.83.187.68]) by grassyhill.org (8.11.0/8.11.0) with ESMTP id h7N3wTt92350 for ; Fri, 22 Aug 2003 23:58:29 -0400 (EDT) - ---------- That IP (67.83.187.68) in the headers is the giveaway: somebody whose initials are presumably R.W., a Cablevision s_bscriber in New Jersey who doesn't use current antivirus software and who clicked on the attachment, dear thing. I don't care or know who R.W. is, I just know that none of the 190-odd messages from her/his IP address in the last 48 hours has contained anything but you-know-what; so for now at least, 67.83.187.68 can't send me or my lists mail. The only reason this approach is even slightly practicable is the highly "bunched" nature of this worm. I know, I know, this ain't a virus list, but there are some reasonably smart people on it, and this is a widely misunderstood phenomenon, so I thought I'd spew just a bit. ------------------------------ Date: Sat, 23 Aug 2003 14:01:10 -0400 From: "Kristen Myshrall" Subject: Re: [lucy-list] VIRUSES/ Virii If your virus protection is updated and it didn't show up on check then you're probably fine. You can always do a search for this file...W32.Sobig.F if you don't have it then you're fine... The reason it looks like its coming from your email is explained below W32.Sobig.F@mm uses a technique known as "email spoofing," by which the worm randomly selects an address it finds on an infected computer. For more information on email spoofing, see the "Technical Details" section below. Email spoofing W32.Sobig.F@mm uses a technique known as "spoofing," by which the worm randomly selects an address it finds on an infected computer. The worm uses this address as the "From" address when it performs its mass-mailing routine. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to another individual. For example, Linda Anderson is using a computer infected with W32.Sobig.F@mm. Linda is neither using an antivirus program nor has the current virus definitions. When W32.Sobig.F@mm performs its email routine, it finds the email address of Harold Logan. The worm inserts Harold's email address into the "From" portion of an infected message, which it then sends to Janet Bishop. Then, Janet contacts Harold and complains that he sent her an infected message; however, when Harold scans his computer, Norton AntiVirus does not find anything, because his computer is not infected. >From: "Gina" >Reply-To: lucy-list@smoe.org >To: >Subject: Re: [lucy-list] VIRUSES/ Virii >Date: Sat, 23 Aug 2003 10:52:30 -0700 > >I, like everyone else, have received a lot of these suspicious emails from >the Lucy-list. Fortunately I have deleted them all before opening the >attachments. Is there any way to get infected if you don't open the >attachments? I ran a virus scan on my hard drive and there were no viruses >detected. Is there any way to know if your email account is sending out >viruses to people? My yahoo account sent me a msg. saying that they found >one and it used my yahoo email address in the explanation of who it was >from. If anyone knows, please share. > >Gina >----- Original Message ----- >From: "Tom Neff" >To: >Sent: Saturday, August 23, 2003 6:26 AM >Subject: Re: [lucy-list] VIRUSES/ Virii > > > > --On Saturday, August 23, 2003 9:13 AM -0400 Bill Stewart > > wrote: > > > > > My sympathies for all those affected by the worm. > > > > > > Of course, if you either used netscape/mozilla, > > > > > > OR > > > Switched to linux this would not affect you. > > > > Certainly it would, because even though uninfected, you would still be > > inundated with messages from others, and with responses from scanners >and > > people worldwide who *think* they got it from you. Worms that fake the > > From: field leave nobody undisturbed. If your address is out there, >you're > > a target. > > > > The best thing to do if your system allows it, for now, is to block by >IP. > > Unlike the previous background level of virus chatter, this one seems to > > sit on an individual machine and BLAST everyone in the address > > book/mailspool repeatedly. I had 148 (out of 200 total) messages today > > from one IP - some poor Canadian victim. Yesterday it was a different >IP. > > Just look in the headers. _________________________________________________________________ Get MSN 8 and enjoy automatic e-mail virus protection. http://join.msn.com/?page=features/virus ------------------------------ Date: Sat, 23 Aug 2003 18:50:21 -0400 From: "Kristen Myshrall" Subject: [lucy-list] Broken Strings...and unbelievable boredome Well my thesis defended (YAY!!!) and i now have WAY too much time on my hands...so I've decided once again to try to teach myself to play the guitar. I have come to the conclusion that A. I can't play half of the chords--my fingers just do NOT bend in those ways---you people who play are freaks or something B. I continually break strings C. I SUCK sooo i came up with this lovely parody Broken Strings ______________ You can have my guitar Just take it back It's been used and broken And it only comes in black It's been sitting in my livingroom It got dusty along the way If I give it to you will you play it right And wipe my bad vibes away Oh you can have my guitar If you don't mind broken strings You can have it now If you don't mind the sound I heard that you make things sound good So I give this thing to you If you want it you can have my guitar So beyond repair Nothing I can do I tried to play it myself, but it only sounded worse when i got through Then you walk right in and take it And you make it sound so neat And you hold it like a child til it's playing melodies sounding so sweet Oh you can have my guitar If you don't mind broken strings You can have it now If you don't mind the sound I heard that you make things sound good So I give this thing to you If you want it you can have my guitar Someone rescue me from my unbelievable boredom....or another parody might be on the way after I go drinking tonight (hmmm....I could drink you under the table, I could drink you out of town, I could drink you off the planet....oh hey wait...that ones been written already) - -Kristen _________________________________________________________________ Help protect your PC: Get a free online virus scan at McAfee.com. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 ------------------------------ Date: Sat, 23 Aug 2003 18:52:41 -0400 From: Phil Kalina <76106.566@compuserve.com> Subject: Re: [lucy-list] Is there any way to know ... At 23 Aug 2003 14:01:10 -0400 (edt), Kristen wrote: > > If your virus protection is updated and it didn't show up on check then you're probably fine. You can always do a search for this file...W32.Sobig.F if you don't have it then you're fine... > ... Kristen is partially right in her answer to Gina's question--you can search for a file to see if your computer is infected with Sobig.F, but the name of that file is winppr32.exe. If there's no winppr32.exe in your Windows installation folder (usually C:\Windows or C:\Winnt), you don't have Sobig.F. But as Tom said, that doesn't mean there's not another computer somewhere that IS infected and is sending emails including some claiming to be from you. The emails have stopped for now--maybe somebody has finally cleaned the computer at 67.83.187.68. When they started up again last night I reported the problem in another email to abuse@optonline.net but, ha, I got a reply saying my email could not be delivered because the disk space at the receiving computer was full. Is Optimum Online also being overwhelmed by wormy email? Maybe they're getting millions of abuse reports from frustrated folks (mostly not their customers) like us. Back to music. I'm going to Jammin' Java in Vienna, Virginia, tonight to hear the Susan Greenbaum Band. I first became acquainted with Susan's music when she opened for Lucy at Ashland Coffee and Tea some time ago. Should be fun. - - Phil ------------------------------ Date: Sun, 24 Aug 2003 01:48:11 -0400 From: Phil Kalina <76106.566@compuserve.com> Subject: [lucy-list] Famous New Yorker, no longer non-driving At 22 Aug 2003 08:37:52 -0400 (edt), Benay wrote: > ... > 'cause it's got to be hard to be a non-driving folk singer... I guess so! In Sunday's Times, Suzanne Vega writes about taking lessons in Manhattan and getting her driver's license. See http://www.nytimes.com/2003/08/24/nyregion/24feat.html (nytimes.com is free, but you have to register. Read it before Aug 31--they charge a fee to access articles more than 7 days after they were published.) ------------------------------ End of lucy-list-digest V5 #172 ******************************* This has been a posting from the Lucy Kaplansky mail list digest To unsubscribe send mail to Majordomo@smoe.org with "unsubscribe lucy-list-digest" in the body of the message