Swen virus from ras?

[Eric Greenwell]

I've been receiving about 15 emails a day for several days with the
Swen virus attached. Since this is the most likely group to have the
email address I use here, I suggest anyone with this address do a
virus scan on their computer.
--
!Replace DECIMAL.POINT in my e-mail address with just a . to reply
directly

Eric Greenwell
Richland, WA (USA)

[Tim Olson]

In article >,
Eric Greenwell > wrote:

| I've been receiving about 15 emails a day for several days with the
| Swen virus attached. Since this is the most likely group to have the
| email address I use here, I suggest anyone with this address do a
| virus scan on their computer.

The virus is not coming from a computer of someone reading this
newsgroup (at least it is not likely). The SWEN virus ("NEWS, spelled
backwards) has a list of open NNTP News servers to which it connects and
harvests email addresses from current news postings.
See http://www.f-secure.com/v-descs/swen.shtml for more details.

Best thing you can do is post with a "munged" email address (as you now
appear to be doing), but your unmunged address will continue to be
harvested as long as it exists on various news servers.

-- Tim Olson

[Eric Greenwell]

In article <fa6nxvc102-9D8A10.11013112102003
@central.isp.giganews.com>, says...
> In article >,
> Eric Greenwell > wrote:
>
> | I've been receiving about 15 emails a day for several days with the
> | Swen virus attached. Since this is the most likely group to have the
> | email address I use here, I suggest anyone with this address do a
> | virus scan on their computer.
>
> The virus is not coming from a computer of someone reading this
> newsgroup (at least it is not likely). The SWEN virus ("NEWS, spelled
> backwards) has a list of open NNTP News servers to which it connects and
> harvests email addresses from current news postings.
> See http://www.f-secure.com/v-descs/swen.shtml for more details.
>
> Best thing you can do is post with a "munged" email address (as you now
> appear to be doing), but your unmunged address will continue to be
> harvested as long as it exists on various news servers.

Sigh. Remember when we used to wonder what the next "killer app"
program would be? I'm beginning to think it will be (is?) a virus,
only with "killer" having different meaning.
--
!Replace DECIMAL.POINT in my e-mail address with just a . to reply
directly

Eric Greenwell
Richland, WA (USA)

[Dylan Smith]

On Sun, 12 Oct 2003 11:04:19 -0700, Eric Greenwell <flyguy26e@charter
DECIMAL.POINTnet> wrote:
>Sigh. Remember when we used to wonder what the next "killer app"
>program would be? I'm beginning to think it will be (is?) a virus,
>only with "killer" having different meaning.

To date, I have rejected over 1.6GB of Swen laden emails. Good job I have
plenty of bandwidth.

I reject all Windows executables at the mail server.
--
Dylan Smith, Castletown, Isle of Man
Flying: http://www.dylansmith.net
Frontier Elite Universe: http://www.alioth.net
"Maintain thine airspeed, lest the ground come up and smite thee"