Computer Chess Club Archives


Search

Terms

Messages

Subject: Re: OT received some faked ICD mails today with Bloodhound virus

Author: Mridul Muralidharan

Date: 22:01:04 04/27/04

Go up one level in this thread


On April 28, 2004 at 00:06:17, Christophe Theron wrote:

>On April 27, 2004 at 17:55:17, Mridul Muralidharan wrote:
>
>>On April 27, 2004 at 16:52:31, Christophe Theron wrote:
>>
>>>On April 27, 2004 at 16:26:07, Mridul Muralidharan wrote:
>>>
>>>>On April 27, 2004 at 15:36:22, Christophe Theron wrote:
>>>>
>>>>>On April 27, 2004 at 13:04:14, Peter Skinner wrote:
>>>>>
>>>>>>On April 27, 2004 at 09:20:26, Günther Simon wrote:
>>>>>>
>>>>>>>"Return-Path: <icd@icdchess.com>
>>>>>>>Received: from marek.org ([213.173.216.226]) by mailin06.sul.t-online.de"
>>>>>>>
>>>>>>>marek.org seems to be a strange site BTW...
>>>>>>>http://www.marek.org/
>>>>>>>
>>>>>>>Günther
>>>>>>
>>>>>>I have recieved the same. Someone on the board probably has ICD Chess in their
>>>>>>address book, and it is sending to everyone in it.
>>>>>>
>>>>>>Just in case I ever do get a worm virus it isn't going anywhere. Just create a
>>>>>>new contact in your address book with the name 0000, and no email address. It
>>>>>>stops the virus from proceeding.
>>>>>>
>>>>>>Peter.
>>>>>
>>>>>
>>>>>
>>>>>I don't see why it would stop a virus from proceeding with the next entry in
>>>>>your address book.
>>>>>
>>>>>Urban legend? Hoax?
>>>>>
>>>>>
>>>>>
>>>>>    Christophe
>>>>
>>>>Most of the new "viruses" (more like worms by script kiddies) are horribly buggy
>>>>and not very well thought out :)
>>>>If indeed this "0000" solution stops this particular virus - then it points to a
>>>>bug in it ... looks like not only commercial s/w and chess programs , but
>>>>viruses also have bugs in them ;)
>>>>
>>>>Mridul
>>>
>>>
>>>
>>>What about:
>>>1) not opening attachments that end with .pif .com .exe .bat .scr .vbs and so
>>>on?
>>>2) using a more secure operating system (Linux comes to mind)
>>>
>>>I have been doing 1 for many years and never got infected when I was using
>>>Windows (and I have received thousands of virii in that period of time).
>>>
>>>I'm doing 2 now and have a good laugh at those your_document.pif attached files.
>>>
>>>If you believe that creating a 0000 contact in your address book will protect
>>>you... go ahead... you can also use paper condoms.
>>>
>>>
>>>
>>>    Christophe
>>
>>True , prevention is better than cure .... though you cannot implictly assume
>>that using linux means assured more security than windows (which gives the
>>impression to be amazingly insecure !) - there are indeed worms , exploits , etc
>>for linux which can have as much effect on your machine as a virus/worm in
>>windows : though definitely they are less common and typically require some user
>>negligence to infect/propogate.
>>
>>I have been using windows , solaris and linux for many years now without any
>>worm/viral infection on my machines .... mails are not the only virus entry
>>points to your machine , though nowadays it is the most common one.
>>Using some mail clients which automatically execute macros , etc can also be an
>>invitation for infections.
>>
>>In the above case though , it is someone else who is infected and Günther Simon
>>got a mail from the infected system ...
>>I do hope that Peter did some "testing" before arriving at the 0000 solution to
>>combat this virus ;)
>
>
>
>My problem with this 0000 trick is that I fail to see why Peter even mentionned
>it.
>
>I don't care if it works or not.
>
>If it works, it works with one kind of bugged virii. Does not protect you from
>the rest anyway.
>
>If it does not work... it protects you from nothing.
>
>So what's the point in mentionning it?
>
>Worse, what's the point in USING it?
>
>
>
>    Christophe
>

True , this is not a solution in the traditional sense - better is to protect
yourself than to try out ideas like this.
It looks more like a temporary solution to "shutup" a class of buggy viruses
(maybe all using the same engine/libraries ;) ) which exhibit this anamoly of
assuming no more addresses when it sees no more info in address book associated
with this "0000" entry (0000 so that it heads the addresses in address book :
typically these mass mailling worms just serially pick up first N addresses from
adderss book and mail themselves).

When most of your private network/lan of say 100+ pc's in a small/medium office
gets affected and it is taking some time to clean up all of these machines ...
then it is better to try out things like this to reduce the n/w congestion ;)
The melissa (and its varients) was quiet virulent and cost quiet a bit in this
way too ...

So there is a corner case where people might try out his idea :)
(Ofcourse , this will not work with all viruses , and also does not clean the
virus - but contains it , and better is to clean than to try these : but not
entirely without use)

Mridul


>
>
>
>
>
>>(BTW bloodhound , indicated above, is not a virus name but indicates that
>>Günther Simon might be using nav and it detected unknown virus)
>>
>>Mridul



This page took 0 seconds to execute

Last modified: Thu, 15 Apr 21 08:11:13 -0700

Current Computer Chess Club Forums at Talkchess. This site by Sean Mintz.