OT: Bomba/Matt Help! E-mail infected!

[X]

Guys if you are reading this, I may have stopped the worm or what ever it was from attacking my
computer. What was happening was my real message was replaced with spam. Annoying, but was the
hacker possibly able to log into my email account? If so I have to change all of my passwards.
That's going to suck.

What programs make the best firewalls? Was it a worm or what how did it get onto my
computer...any ideas?

X

 

[Eric Lafferty]

x wrote:

> Guys if you are reading this, I may have stopped the worm or what ever it was from attacking my
> computer. What was happening was my real message was replaced with spam. Annoying, but was the
> hacker possibly able to log into my email account? If so I have to change all of my passwards.
> That's going to suck.
>
> What programs make the best firewalls? Was it a worm or what how did it get onto my
> computer...any ideas?
>
> X

Ummm.... that's not a lot of info to go on.

Did you go to the FTP site? What happened?

What OS do you run?

 

[Bomba]

x wrote:
> Guys if you are reading this, I may have stopped the worm or what ever it was from attacking my
> computer. What was happening was my real message was replaced with spam. Annoying, but was the
> hacker possibly able to log into my email account? If so I have to change all of my passwards.
> That's going to suck.

I'm confused here - you're giving contradictory statements. A worm self-replicates automatically,
where as a cracker uses means of manual intervention.

Secondly, I need a hell of a lot more information. When you say that your 'real message was replaced
with spam', how exactly do you mean? Are you getting returned mails? Do they appear in your sent
items? What is the content of the spam?

>
> What programs make the best firewalls?

It's not perfect, but for a beginner, Zone Labs' Zone Alarm is ok: www.zonelabs.com

Do you have anti-virus protection? If not, use the free virus scanner from GRI - www.grisoft.com and
scan your machine

> Was it a worm or what how did it get onto my computer...any ideas?

I have lots of ideas, but without more info, I can't really diagnose the problem. If you can, find
one of the offending messages and hit ctrl +
F3. You'll get a pop-up box with the 'Message Source'. Copy this and mail it to me and this should
give me a better idea.

--
G.m-b FAQ: http://www.t-online.de/~jharris/ambfaq.htm

H.bmx FAQ: http://www.t-online.de/~jharris/bmx_faq.htm

 

[Matthew Paterso]

x wrote:

> What programs make the best firewalls?

Linux, and the Firewall-HOWTO.

--
Matt

Fear of a flat planet

 

[X]

"bomba" <[email protected]> wrote in message news:[email protected]...
> x wrote:
> > Guys if you are reading this, I may have stopped the worm or what ever
it
> > was from attacking my computer. What was happening was my real message was replaced with spam.
> > Annoying,
but
> > was the hacker possibly able to log into my email account? If so I have
to
> > change all of my passwards. That's going to suck.
>
> I'm confused here - you're giving contradictory statements. A worm self-replicates automatically,
> where as a cracker uses means of manual intervention.

I sent a message (LMAO Bait for the troll) to alt.mountain-bike and it was posted as a spam to
visit a ftp site for a Beck movie. I was never at that site. The header on the message that made it
to the group was no where near what mine is. The spam came from Texas. I deleted all my mail, so
I'm not sure what the actual header was like. Someone still might have the original message saved
on their computer.
>
> Secondly, I need a hell of a lot more information. When you say that your 'real message was
> replaced with spam', how exactly do you mean?

Another post I made to a group was posted as a site for an on-line auction service. The header was
from some guy in texas. Sorry about not being much help, but I know jack about how this kind of
thing is done.

> Are you getting returned mails? Do they appear in your sent items? What is the content of
> the spam?

The messages in my sent items were clean, so they must have been sent to who ever was turning
them to spam, and the spammer was posting the finalized message. I only had a couple of returned
mails, but those were in question, because they were from the same address, and I might have
typed them wrong.

> > What programs make the best firewalls?
>
> It's not perfect, but for a beginner, Zone Labs' Zone Alarm is ok: www.zonelabs.com
>
> Do you have anti-virus protection? If not, use the free virus scanner from GRI - www.grisoft.com
> and scan your machine
>
> > Was it a worm or what how did it get onto my computer...any ideas?
>
> I have lots of ideas, but without more info, I can't really diagnose the problem. If you can, find
> one of the offending messages and hit ctrl +
> F3. You'll get a pop-up box with the 'Message Source'. Copy this and mail it to me and this
> should give me a better idea.
>
> --
> a.m-b FAQ: http://www.t-online.de/~jharris/ambfaq.htm
>
> a.bmx FAQ: http://www.t-online.de/~jharris/bmx_faq.htm

 

[G.T.]

Matthew Paterson wrote:
> x wrote:
>
>
>>What programs make the best firewalls?
>
>
> Linux, and the Firewall-HOWTO.
>

Puhlease. Linux, an OS with more exploits than NT/Win2000?

OpenBSD and pf. http://www.openbsd.org

Greg

--
"Destroy your safe and happy lives before it is too late, the battles we fought were long and hard,
just not to be consumed by rock n' roll..." - The Mekons

 

[Mattb]

"G.T." <[email protected]> wrote in message
news:[email protected]...
> Matthew Paterson wrote:
> > x wrote:
> >
> >
> >>What programs make the best firewalls?
> >
> >
> > Linux, and the Firewall-HOWTO.
> >
>
> Puhlease. Linux, an OS with more exploits than NT/Win2000?
>
> OpenBSD and pf. http://www.openbsd.org
>
> Greg
>

Neither is really appropriate for someone who is admittedly not an expert on computers. My
recommendation would be to use a decent commercial firewall like Zone Alarm or Sygate on a recent
version of Windows (2000 or XP) with all the latest patches on it.

Matt

 

[Martees]

"MattB" <[email protected]> wrote in message news:[email protected]...
> "G.T." <[email protected]> wrote in message
> news:[email protected]...
> > Matthew Paterson wrote:
> > > x wrote:
> > >
> > >
> > >>What programs make the best firewalls?
> > >
> > >
> > > Linux, and the Firewall-HOWTO.
> > >
> >
> > Puhlease. Linux, an OS with more exploits than NT/Win2000?
> >
> > OpenBSD and pf. http://www.openbsd.org
> >
> > Greg
> >
>
> Neither is really appropriate for someone who is admittedly not an expert
on
> computers. My recommendation would be to use a decent commercial firewall like Zone Alarm or
> Sygate on a recent version of Windows (2000 or XP) with all the latest patches on it.
>
> Matt
>
>

Zone Alarm, XP, and Norton are a good trio. If I had NOTHING else I'd run Zone Alarm. The free $hit.
Don't pay for it.

Marty

 

[Chris Phillipo]

In article <[email protected]>, [email protected] says...
>
> "MattB" <[email protected]> wrote in message news:[email protected]...
> > "G.T." <[email protected]> wrote in message
> > news:[email protected]...
> > > Matthew Paterson wrote:
> > > > x wrote:
> > > >
> > > >
> > > >>What programs make the best firewalls?
> > > >
> > > >
> > > > Linux, and the Firewall-HOWTO.
> > > >
> > >
> > > Puhlease. Linux, an OS with more exploits than NT/Win2000?
> > >
> > > OpenBSD and pf. http://www.openbsd.org
> > >
> > > Greg
> > >
> >
> > Neither is really appropriate for someone who is admittedly not an expert
> on
> > computers. My recommendation would be to use a decent commercial firewall like Zone Alarm or
> > Sygate on a recent version of Windows (2000 or XP) with all the latest patches on it.
> >
> > Matt
> >
> >
>
> Zone Alarm, XP, and Norton are a good trio. If I had NOTHING else I'd run Zone Alarm. The free
> $hit. Don't pay for it.
>
> Marty
>
>
>
>
http://www.grc.com, he did a review of many free and shareware firewalls, I'm not sure if it's
still there.
--
_________________________
Chris Phillipo - Cape Breton, Nova Scotia http://www.ramsays-online.com

 

[Bomba]

G.T. wrote:

>>> What programs make the best firewalls?
>>
>>
>>
>> Linux, and the Firewall-HOWTO.
>>
>
> Puhlease. Linux, an OS with more exploits than NT/Win2000?

Hmm, big call. From a number point of view, you may well be right, but the gravity of the exploits
and the way that they are exploited means that I would always install an Internet-facing Linux
machine over a Win machine. Of course, both are capable of being highly secure in the hands of a
good admin.

> OpenBSD and pf. http://www.openbsd.org

Agreed. Although I believe an OpenBSD / PF, or even a Linux / IPTables firewall, is well out of the
realms of the OP.

 

[Bomba]

Chris Phillipo wrote:

> http://www.grc.com, he did a review of many free and shareware firewalls, I'm not sure if it's
> still there.

And take it with a pinch of salt. Steve Gibson's a melodramatic, attention-seeking nutter. His
personal crusade against Black Ice was disgraceful.

 

[Bomba]

x wrote:

> I sent a message (LMAO Bait for the troll) to alt.mountain-bike and it was posted as a spam to
> visit a ftp site for a Beck movie. I was never at that site. The header on the message that made
> it to the group was no where near what mine is.

When you say 'the header', do you mean the e-mail address?

The spam came from Texas. I deleted all my mail, so I'm not
> sure what the actual header was like. Someone still might have the original message saved on their
> computer.

Well, you did have a message that appeared in the group in that thread, but it looked normal to me.

>>Secondly, I need a hell of a lot more information. When you say that your 'real message was
>>replaced with spam', how exactly do you mean?
>
>
> Another post I made to a group was posted as a site for an on-line auction service. The header was
> from some guy in texas. Sorry about not being much help, but I know jack about how this kind of
> thing is done.
>
>
>>Are you getting returned mails? Do they appear in your sent items? What is the content of
>>the spam?
>
>
>
> The messages in my sent items were clean, so they must have been sent to who ever was turning
> them to spam, and the spammer was posting the finalized message. I only had a couple of returned
> mails, but those were in question, because they were from the same address, and I might have
> typed them wrong.

Sorry, but your description is too vague. I can't really do much without seeing the messages with
the full headers. I'll take a stab in the dark, and say that if you're actually sending the message,
and it's adding stuff on / altering the content to spam, then maybe it's some kind of vicious
adware. Try running AdAware: www.lavasoftusa.com

 

[El Barista]

"bomba" <[email protected]> wrote in message news:[email protected]...

> And take it with a pinch of salt. Steve Gibson's a melodramatic, attention-seeking nutter. His
> personal crusade against Black Ice was disgraceful.

Have you seen http://www.grcsucks.com/?

-will

 

[Bomba]

El Barista wrote:

>>And take it with a pinch of salt. Steve Gibson's a melodramatic, attention-seeking nutter. His
>>personal crusade against Black Ice was disgraceful.
>
>
> Have you seen http://www.grcsucks.com/?

Have indeed and had actually totally forgotten about it. Will have to have a bit of a read tomorrow.

 

[Eric Lafferty]

Martees wrote:

> Zone Alarm, XP, and Norton are a good trio. If I had NOTHING else I'd run Zone Alarm. The free
> $hit. Don't pay for it.
>
> Marty

XP is bad news. I'd not recommend it to anyone. Win2000 is a safe bet for someone who knows nothing.