Date:         Tue, 7 May 2002 17:45:02 -0400
Reply-To:     David Beierl <dbeierl@ATTGLOBAL.NET>
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         David Beierl <dbeierl@ATTGLOBAL.NET>
Subject:      Re: TO LIST ADMIN - mea culpa
Comments: To: bmuller@uoft02.utoledo.edu
In-Reply-To:  <3CD844C2.8EF83CA7@uoft02.utoledo.edu>
Content-Type: text/plain; charset="us-ascii"; format=flowed

At 05:18 PM 5/7/2002, Barry E. Muller wrote:
>I don't know if I'm the only source to this list, but I did have to get an
>update for my anti-virus software to clean the klez-worm from my POS PC.

Nowadays <sigh> your definitions are out of date if they're more than a
couple days old.  I have gotten as many as three updates in a single
day!  Norton Antivirus presently protects against roughly sixty-one
thousand viruses.  Most of them are extremely rare or haven't appeared "in
the wild" -- but there's a steady trickle of new stinkers and variations on
old ones.

>Another advantage to a Mac - too rare for most hackers to waste their time
>writing nasty code for.

Absolutely.  Ironic that if Apple has a marketing breakthrough, one of
their big selling points will go away...

>  Have no idea where it came from - is there a way to
>find out?

With Klez you can examine the headers and find out what IP address the
thing actually came from.  Figuring out who was using that address at the
time is not so simple.  It helps somewhat that the infected machine will
have both your address and the one that the message supposedly came from --
you can do some elimination if you have several samples to work with.  Also
most versions of Klez will do serious damage to infected machines of the
sixth of each odd month, so people tend to notice when that happens and
realize that something is wrong.

david


--
David Beierl - Providence, RI
  http://pws.prserv.net/synergy/Vanagon/
'84 Westy "Dutiful Passage"
'85 GL "Poor Relation"