Mark's comp may have a VIRUS

[Mark_Everson]

Hi All:

I don't know anything for sure at this point, but I got some emails bounced back from addresses I never sent email to!

One of them said "553 5.0.0 This message MAY contain Klez virus"

I am now running the in-depth virus software I have, since obviously the one that works in the background may not have done the job. Suggest everyone that's gotten email from me in the last week or so does the same if you've got one.

I will post further when I know something. For obvious reasons I'm not going to send out any emails till I get this resolved.

Gary:

My email is now working, and I have received the latest code from you with the header Economics orders done. And one before that that says new source.

[Gary Thomas]

You cannot get a virus through email itself, only through running an executable file (or in perhaps a MS Office macro).

I will be sending a new one soon. I keep getting crashes in the economics code.

Cheers

[Mark_Everson]

Hi Gary:

So what do you think, is someone just using my email addr to send out spam? I guess that's an alternative explanation... I like it somewhat better than a virus, though it could have its downside too if they start sending out a lot.

On crashes in the econ code, l just sent you an email about that. I'm assuming your crashes are the same as the ones I experienced! I don't think its the econ code itself, but rather a bug in the xml init for delenda. That's becuase I fixed the initial econ crash, and then it crashed this way instead:

java.lang.ArithmeticException: / by zero
at game.geography.gui.OverviewMapPanel.calculateTileS ize(OverviewMapPanel.java:130)
at game.geography.gui.OverviewMapPanel.setPreferredSi ze(OverviewMapPanel.java:73)
at game.geography.gui.OverviewMapFrame.(OverviewMapFrame.java:52)
at game.geography.gui.OverviewMapFrame.getInstance(Ov erviewMapFrame.java:34)
at game.gui.Start.game(Start.java:37)
at game.manager.Game$ScenarioFileSelection.execute(Ga me.java:154)
at game.manager.Game.(Game.java:72)
at game.manager.GameMain.main(GameMain.java:10)

[Gary Thomas]

I won't pursue this in this thread, see the main D7 one.

Cheers

[Mark_Everson]

Well, the in-depth scan came up clean, so I guess it ain't a virus after all!

Sorry for the false alarm.

[axi]

Have you checked out the Klez virus to see what kind it is? If it is a worm, it CAN spread through e-mail (worms mail themselves to everyone in your address book).

[Mark_Everson]

Hi Axi, yes it is a worm, and here's a link that tells about it:

http://vil.mcafee.com/dispVirus.asp?virus_k=99455

But I don't have any symptoms other than the weird emails, and the comp checked out clean. Of course that doesn't prove anything, but McAfee claims they have been protecting agianst its ilk for quite some time, and all my anti-virus files have been updated on about a weekly basis. My best guess is that since it can "spoof the From: field" that someone who has my email address on their comp had the virus.

Will let people know if any new info becomes available.

[Straybow]

OOooh, the version that claims to be a protection program that is a fake Klez that fools the real Klez… very sneaky.

Back at the begining of May I got some Klez emails from Apolytoners who were on The List (Civ3 Wishlist) project back in '99-'00. Fortunately for me it exploits the "internal attachment" feature of MS Outlook, which means Netscape Messenger is immune.

The internal attachment runs automatically if you open or preview the email. AOL uses MS Outlook code/dlls and is vulnerable. The only guy I know personally who was hit is on AOL, and he doesn't recall opening any such emails but thinks the preview pane might have been open. I don't know about Eudora, it may or may not use MS code. Opera should not be vulnerable. Klez is still going around; I received another just a week or two ago.

Klez, Dexter, and some similar worms use the SMTP link directly to send emails with your header or a faked header. I got one that said it was from "postmaster@mindspring.com," very official sounding to some who might not know better. The path revealed it came from somewhere in the Netherlands.

Anyway, if an email has a fake header with your address I didn't think it would come back to you. The mailer-daemon usually returns mail to the top of the sending path rather than blindly to the alleged sending address. Unless you mean it was bounced by a receiving party's virus software?

The worm accesses the SMTP without going through your browser or mail program so it doesn't leave a copy in your "Sent" folder. Your ISP would be able to provide you with copies or addresses of all emails sent from your pop address.

If you got wormed you'll see several hundred unfamiliar emails. It doesn't just look at your address book and senders/receivers in your inbox/sent folders, it also finds other addresses in the To: or CC: fields of mail in your inbox. That's how it can be sent to people who've never sent or received emails to or from you.

[Mark_Everson]

Thanks for the info Straybow. I don't know what I had, but it seems to be gone!

[chequita guevara]

Perhaps you should lock this thread and let it die to keep from giving people momentary heart attacks?

[Mark_Everson]

Good idea, my apologies!