Computer Chess Club Archives


Search

Terms

Messages

Subject: Re: OT received some faked ICD mails today with Bloodhound virus

Author: Mridul Muralidharan

Date: 22:32:38 04/27/04

Go up one level in this thread


Seeing the vitriol in the other posts in this thread ... I should have just shut
up and not posted the previous post.

Mridul



On April 28, 2004 at 01:01:04, Mridul Muralidharan wrote:

>On April 28, 2004 at 00:06:17, Christophe Theron wrote:
>
>>On April 27, 2004 at 17:55:17, Mridul Muralidharan wrote:
>>
>>>On April 27, 2004 at 16:52:31, Christophe Theron wrote:
>>>
>>>>On April 27, 2004 at 16:26:07, Mridul Muralidharan wrote:
>>>>
>>>>>On April 27, 2004 at 15:36:22, Christophe Theron wrote:
>>>>>
>>>>>>On April 27, 2004 at 13:04:14, Peter Skinner wrote:
>>>>>>
>>>>>>>On April 27, 2004 at 09:20:26, Günther Simon wrote:
>>>>>>>
>>>>>>>>"Return-Path: <icd@icdchess.com>
>>>>>>>>Received: from marek.org ([213.173.216.226]) by mailin06.sul.t-online.de"
>>>>>>>>
>>>>>>>>marek.org seems to be a strange site BTW...
>>>>>>>>http://www.marek.org/
>>>>>>>>
>>>>>>>>Günther
>>>>>>>
>>>>>>>I have recieved the same. Someone on the board probably has ICD Chess in their
>>>>>>>address book, and it is sending to everyone in it.
>>>>>>>
>>>>>>>Just in case I ever do get a worm virus it isn't going anywhere. Just create a
>>>>>>>new contact in your address book with the name 0000, and no email address. It
>>>>>>>stops the virus from proceeding.
>>>>>>>
>>>>>>>Peter.
>>>>>>
>>>>>>
>>>>>>
>>>>>>I don't see why it would stop a virus from proceeding with the next entry in
>>>>>>your address book.
>>>>>>
>>>>>>Urban legend? Hoax?
>>>>>>
>>>>>>
>>>>>>
>>>>>>    Christophe
>>>>>
>>>>>Most of the new "viruses" (more like worms by script kiddies) are horribly buggy
>>>>>and not very well thought out :)
>>>>>If indeed this "0000" solution stops this particular virus - then it points to a
>>>>>bug in it ... looks like not only commercial s/w and chess programs , but
>>>>>viruses also have bugs in them ;)
>>>>>
>>>>>Mridul
>>>>
>>>>
>>>>
>>>>What about:
>>>>1) not opening attachments that end with .pif .com .exe .bat .scr .vbs and so
>>>>on?
>>>>2) using a more secure operating system (Linux comes to mind)
>>>>
>>>>I have been doing 1 for many years and never got infected when I was using
>>>>Windows (and I have received thousands of virii in that period of time).
>>>>
>>>>I'm doing 2 now and have a good laugh at those your_document.pif attached files.
>>>>
>>>>If you believe that creating a 0000 contact in your address book will protect
>>>>you... go ahead... you can also use paper condoms.
>>>>
>>>>
>>>>
>>>>    Christophe
>>>
>>>True , prevention is better than cure .... though you cannot implictly assume
>>>that using linux means assured more security than windows (which gives the
>>>impression to be amazingly insecure !) - there are indeed worms , exploits , etc
>>>for linux which can have as much effect on your machine as a virus/worm in
>>>windows : though definitely they are less common and typically require some user
>>>negligence to infect/propogate.
>>>
>>>I have been using windows , solaris and linux for many years now without any
>>>worm/viral infection on my machines .... mails are not the only virus entry
>>>points to your machine , though nowadays it is the most common one.
>>>Using some mail clients which automatically execute macros , etc can also be an
>>>invitation for infections.
>>>
>>>In the above case though , it is someone else who is infected and Günther Simon
>>>got a mail from the infected system ...
>>>I do hope that Peter did some "testing" before arriving at the 0000 solution to
>>>combat this virus ;)
>>
>>
>>
>>My problem with this 0000 trick is that I fail to see why Peter even mentionned
>>it.
>>
>>I don't care if it works or not.
>>
>>If it works, it works with one kind of bugged virii. Does not protect you from
>>the rest anyway.
>>
>>If it does not work... it protects you from nothing.
>>
>>So what's the point in mentionning it?
>>
>>Worse, what's the point in USING it?
>>
>>
>>
>>    Christophe
>>
>
>True , this is not a solution in the traditional sense - better is to protect
>yourself than to try out ideas like this.
>It looks more like a temporary solution to "shutup" a class of buggy viruses
>(maybe all using the same engine/libraries ;) ) which exhibit this anamoly of
>assuming no more addresses when it sees no more info in address book associated
>with this "0000" entry (0000 so that it heads the addresses in address book :
>typically these mass mailling worms just serially pick up first N addresses from
>adderss book and mail themselves).
>
>When most of your private network/lan of say 100+ pc's in a small/medium office
>gets affected and it is taking some time to clean up all of these machines ...
>then it is better to try out things like this to reduce the n/w congestion ;)
>The melissa (and its varients) was quiet virulent and cost quiet a bit in this
>way too ...
>
>So there is a corner case where people might try out his idea :)
>(Ofcourse , this will not work with all viruses , and also does not clean the
>virus - but contains it , and better is to clean than to try these : but not
>entirely without use)
>
>Mridul
>
>
>>
>>
>>
>>
>>
>>>(BTW bloodhound , indicated above, is not a virus name but indicates that
>>>Günther Simon might be using nav and it detected unknown virus)
>>>
>>>Mridul



This page took 0 seconds to execute

Last modified: Thu, 15 Apr 21 08:11:13 -0700

Current Computer Chess Club Forums at Talkchess. This site by Sean Mintz.