Shop OBEX P1 Docs P2 Docs Learn Events
Cheap Terminal? (VIRUS! not from this list) — Parallax Forums

Cheap Terminal? (VIRUS! not from this list)

ArchiverArchiver Posts: 46,084
edited 2003-06-09 17:05 in General Discussion
Hello Stampers.

Our settings for the basicstamps list don't allow sending attachments,
to avoid virus propagation.

If someone tries to send an attachment to the list, Yahoo Groups will
remove it, before forwarding the email to the members.

The original email "Re: Cheap Terminal?" doesn't appear in the
basicstamps messages database, so it was DIRECTLY mailed to some of the
members (and former members).

If any of the members from any of the Parallax owned forums receive an
email with an attachment, be aware that for sure it's not coming from
the forum and it could be a virus.

Saludos,
Aristides Alvarez
International Education Program Developer
aalvarez@p...
Parallax, Inc. www.parallax.com
Rocklin, California
USA

Original Message
From: Allan Lane [noparse]/noparse]mailto:[url=http://forums.parallaxinc.com/group/basicstamps/post?postID=Y50KhlyhdWfPzaZUairiFAzz5jI7CPZbD4C07KutIAsT0i7EF1Z9o7NUlAkmbV_t5-splFwi7CZDEcDz9qE-_u3uspIh2JU]allan.lane@h...[/url
Sent: Sunday, June 08, 2003 11:44 AM
To: basicstamps@yahoogroups.com
Subject: [noparse][[/noparse]basicstamps] Re: Cheap Terminal? (VIRUS!)

Yes, I just got it. My VirusScan (McAfee v 4.5.1)
caught it and warned me, but could not clean it.
I 'replied' to the owner with a warning.
It's the new 'BugBear' virus.

--- In basicstamps@yahoogroups.com, "walter woodrow" <oopicwow@y...>
wrote:
> Did anyone get an email with 'Re: [noparse][[/noparse]basicstamps] Cheap Terminal?' as
> the subject? It has a file attachment and it contains the
> W32.Bugbear.B.Dam.
> The message seems to be from "Michael Burr" <mburr@s...> but
> also has that the message was written by verhap@o...
>
> Just want to know if anyone else got it and also to foward this
> warning.


To UNSUBSCRIBE, just send mail to:
basicstamps-unsubscribe@yahoogroups.com
from the same email address that you subscribed. Text in the Subject
and Body of the message will be ignored.


Your use of Yahoo! Groups is subject to
http://docs.yahoo.com/info/terms/

Comments

  • ArchiverArchiver Posts: 46,084
    edited 2003-06-09 02:42
    I received that message too, and noticed that it was an stolen "echo"
    of a message that appeared on this Stamps list back on 2/24/03. I
    don't know how hackers do that kind of thing. But I do know that the
    participants in the message thread that was stolen are in fact good
    contributors to this list. I am positive they had nothing to do with
    the virus infected spam.

    I deleted it and once again was glad I have a Mac, less a target for
    viruses these days!

    -- Tracy






    >Hello Stampers.
    >
    >Our settings for the basicstamps list don't allow sending attachments,
    >to avoid virus propagation.
    >
    >If someone tries to send an attachment to the list, Yahoo Groups will
    >remove it, before forwarding the email to the members.
    >
    >The original email "Re: Cheap Terminal?" doesn't appear in the
    >basicstamps messages database, so it was DIRECTLY mailed to some of the
    >members (and former members).
    >
    >If any of the members from any of the Parallax owned forums receive an
    >email with an attachment, be aware that for sure it's not coming from
    >the forum and it could be a virus.
    >
    >Saludos,
    >Aristides Alvarez
    >International Education Program Developer
    >aalvarez@p...
    >Parallax, Inc. www.parallax.com
    >Rocklin, California
    >USA
    >
    >
    >
    Original Message
    >From: Allan Lane [noparse]/noparse]mailto:[url=http://forums.parallaxinc.com/group/basicstamps/post?postID=C9jjwaGZ84ZB0DCUdEPdvXC8G0tdfOxfX-OjPAHMkzAVrmqnuLcnmTM4VBlxPEHV5-8EKFhFga87Zb5fY0mpdOXXgNRS]allan.lane@h...[/url
    >Sent: Sunday, June 08, 2003 11:44 AM
    >To: basicstamps@yahoogroups.com
    >Subject: [noparse][[/noparse]basicstamps] Re: Cheap Terminal? (VIRUS!)
    >
    >Yes, I just got it. My VirusScan (McAfee v 4.5.1)
    >caught it and warned me, but could not clean it.
    >I 'replied' to the owner with a warning.
    >It's the new 'BugBear' virus.
    >
    >--- In basicstamps@yahoogroups.com, "walter woodrow" <oopicwow@y...>
    >wrote:
    >> Did anyone get an email with 'Re: [noparse][[/noparse]basicstamps] Cheap Terminal?' as
    >> the subject? It has a file attachment and it contains the
    >> W32.Bugbear.B.Dam.
    >> The message seems to be from "Michael Burr" <mburr@s...> but
    >> also has that the message was written by verhap@o...
    >>
    >> Just want to know if anyone else got it and also to foward this
    >> warning.
    >
    >
    >To UNSUBSCRIBE, just send mail to:
    > basicstamps-unsubscribe@yahoogroups.com
    >from the same email address that you subscribed. Text in the Subject
    >and Body of the message will be ignored.
    >
    >
    >Your use of Yahoo! Groups is subject to
    >http://docs.yahoo.com/info/terms/
    >
    >
    >To UNSUBSCRIBE, just send mail to:
    > basicstamps-unsubscribe@yahoogroups.com
    >from the same email address that you subscribed. Text in the
    >Subject and Body of the message will be ignored.
    >
    >
    >Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
  • ArchiverArchiver Posts: 46,084
    edited 2003-06-09 03:14
    --- Tracy Allen <tracy@e...> wrote:
    > I received that message too, and noticed that it was
    > an stolen "echo"
    > of a message that appeared on this Stamps list back
    > on 2/24/03. I

    I too received the message...However, Yahoo allows you
    to scan messages online for a Virus...Found the
    W32.BugBear virus...




    =====
    Chris Savage
    Knight Designs
    324 West Main Street
    Montour Falls, NY 14865
    (607) 535-6777

    http://www.knightdesigns.com

    __________________________________
    Do you Yahoo!?
    Yahoo! Calendar - Free online calendar with sync to Outlook(TM).
    http://calendar.yahoo.com
  • ArchiverArchiver Posts: 46,084
    edited 2003-06-09 04:18
    I'm receiving about 10 virus-infected messages per week, some from this
    list, and others addressed to 'undisclosed recipients'. The latter are
    current (same day) messages sent to other people, as if I'm snooping in
    their mail. The BugBear virus seems to be one that sends random
    messages to others listed in a virus-victim's Outlook address file. All
    messages that I've received have had attachments containing the virus,
    which my anti-virus software has caught and quarantined.

    Dennis
    Original Message
    From: Tracy Allen [noparse]/noparse]mailto:[url=http://forums.parallaxinc.com/group/basicstamps/post?postID=JgRQUEBeiwvxs9NMwACmZuu0d3Xor41ln8Rv-LV7omgcCw7wVZIC_iGCRWqntLyUcwakgkreisH4rrY]tracy@e...[/url
    Sent: Sunday, June 08, 2003 6:42 PM
    To: basicstamps@yahoogroups.com
    Subject: RE: [noparse][[/noparse]basicstamps] Re: Cheap Terminal? (VIRUS! not from this
    list)


    I received that message too, and noticed that it was an stolen "echo"
    of a message that appeared on this Stamps list back on 2/24/03. I
    don't know how hackers do that kind of thing. But I do know that the
    participants in the message thread that was stolen are in fact good
    contributors to this list. I am positive they had nothing to do with
    the virus infected spam.

    I deleted it and once again was glad I have a Mac, less a target for
    viruses these days!

    -- Tracy






    >Hello Stampers.
    >
    >Our settings for the basicstamps list don't allow sending attachments,
    >to avoid virus propagation.
    >
    >If someone tries to send an attachment to the list, Yahoo Groups will
    >remove it, before forwarding the email to the members.
    >
    >The original email "Re: Cheap Terminal?" doesn't appear in the
    >basicstamps messages database, so it was DIRECTLY mailed to some of the

    >members (and former members).
    >
    >If any of the members from any of the Parallax owned forums receive an
    >email with an attachment, be aware that for sure it's not coming from
    >the forum and it could be a virus.
    >
    >Saludos,
    >Aristides Alvarez
    >International Education Program Developer aalvarez@p...
    >Parallax, Inc. www.parallax.com
    >Rocklin, California
    >USA
    >
    >
    >
    Original Message
    >From: Allan Lane [noparse]/noparse]mailto:[url=http://forums.parallaxinc.com/group/basicstamps/post?postID=PDTv_0gBC9sX1J3VqJ3r4ttlEGfto4hHE2SfhXGoD_f9aj4Rq1oARpB49bdfLZ8RJcDZbmcOSaxMUbJqvnDQSsAhwCfgtto]allan.lane@h...[/url
    >Sent: Sunday, June 08, 2003 11:44 AM
    >To: basicstamps@yahoogroups.com
    >Subject: [noparse][[/noparse]basicstamps] Re: Cheap Terminal? (VIRUS!)
    >
    >Yes, I just got it. My VirusScan (McAfee v 4.5.1)
    >caught it and warned me, but could not clean it.
    >I 'replied' to the owner with a warning.
    >It's the new 'BugBear' virus.
    >
    >--- In basicstamps@yahoogroups.com, "walter woodrow" <oopicwow@y...>
    >wrote:
    >> Did anyone get an email with 'Re: [noparse][[/noparse]basicstamps] Cheap Terminal?' as
    >> the subject? It has a file attachment and it contains the
    >> W32.Bugbear.B.Dam. The message seems to be from "Michael Burr"
    >> <mburr@s...> but also has that the message was written by verhap@o...
    >>
    >> Just want to know if anyone else got it and also to foward this
    >> warning.
    >
    >
    >To UNSUBSCRIBE, just send mail to:
    > basicstamps-unsubscribe@yahoogroups.com
    >from the same email address that you subscribed. Text in the Subject
    >and Body of the message will be ignored.
    >
    >
    >Your use of Yahoo! Groups is subject to
    >http://docs.yahoo.com/info/terms/
    >
    >
    >To UNSUBSCRIBE, just send mail to:
    > basicstamps-unsubscribe@yahoogroups.com
    >from the same email address that you subscribed. Text in the
    >Subject and Body of the message will be ignored.
    >
    >
    >Your use of Yahoo! Groups is subject to
    >http://docs.yahoo.com/info/terms/


    To UNSUBSCRIBE, just send mail to:
    basicstamps-unsubscribe@yahoogroups.com
    from the same email address that you subscribed. Text in the Subject
    and Body of the message will be ignored.


    Your use of Yahoo! Groups is subject to
    http://docs.yahoo.com/info/terms/
  • ArchiverArchiver Posts: 46,084
    edited 2003-06-09 04:30
    Original Message
    From: "Dennis O'Leary" <doleary@p...>
    To: <basicstamps@yahoogroups.com>


    > The BugBear virus seems to be one that sends random
    > messages to others listed in a virus-victim's Outlook address file.

    Correct. According to what I know of the virus, it actually forwards
    existing emails from your computer to random people in your address book.
    This is how it was able to get the text of the "Cheap Terminal" thread. It
    stole it from someone's hard-drive and forwarded it to a bunch of people.

    The virus, as others have said, is not coming from the list or through the
    list. it's simply coming from list members with list emails on their
    computers. The only real solution to this is to carefully check and clean
    your computer.

    - Robert
  • ArchiverArchiver Posts: 46,084
    edited 2003-06-09 17:05
    Tracy Allen wrote:

    > I received that message too, and noticed that it was an stolen "echo"
    > of a message that appeared on this Stamps list back on 2/24/03. I
    > don't know how hackers do that kind of thing. But I do know that the
    > participants in the message thread that was stolen are in fact good
    > contributors to this list. I am positive they had nothing to do with
    > the virus infected spam.



    I just received a copy of the virus and noticed that the sender
    on my copy is listed as me (Michael Burr). Of course I did not
    open the .exe attachement that came with it. The message is a
    snippit of a reply I did to the group months ago. I would like
    to assure everyone that I had nothing to do with this other than
    the orignial reply months ago. I'm very careful with virus
    protection and have a dial-up account that hasn't even been
    logged on in the last two days during the time frame this
    message was apparently sent. I took a look at the headers on
    the message and noticed that it was a rather crude spoof as the
    sender is listed as "mburr@s..." which is the right
    user name but wrong domain. The email server listed is also one
    I don't use. I have double checked my machine just to be
    absolutley sure and have found nothing to indicate the source of
    the virus is actually here. It's ashame that there are so many
    losers out there that would rather destroy than create and
    prefer to hide behind others while they do so.... LOSER!

    Michael Burr
Sign In or Register to comment.