So THAT's where they're coming from. My email is not on the list but
I have received 200+ virus laden emails since I posted a question last
week.
I have since altered my email address but I am afraid the damage is
done. Oh well, maybe they will eventually get tired of it.

Thanks for the heads up!!

Bill
On 27 Sep 2003 19:46:34 -0500, noah
wrote:

I received a message today, in Portuguese no less, listing my email
address, and a number of others in this group, as having been
harvested by the W32/swenn@mm worm.

The list is not "all inclusive", meaning that you could still be
targeted even if your addy is not listed. I also know that some are
already invalid, or munged, but I am including the entire list that I
received. There are duplicates. I don't know why.

Be aware that this worm will not only target you, but will send virus
emails listing *you* as the sender. You may get irate mail, or
notices from your ISP, that you are sending virii, when you are not.
The smart ISP's filter for viruses. MANY (i.e. Earthlink), do not.

Also be aware that these addresses (your's and mine) can be
"re-harvested" from the worm, and used for other purposes, such as
sending SPAM, trojan viruses, and other nasty stuff. Your account may
also get hacked, as "they" now know the username, they only need to
hack the password.

I really dislike having to munge my address ("...FISH.net"), and it
get's my Irish up to surrender to these *ssholes, but some of you (me,
included) may wish to consider changing your email address, and
munging it. I'm still thinking about it. I will probably wait to see
if this situation "calms down". I am still receiving about 100
viruses a day, and earthlink bounces them after my account hits 10
megabyte.

I have edited this list, to change the "@" in the addresses to "-at-".
No sense in giving the SPAMbots any food.

Good luck:

To: cristinacoelho-at-epar.jazznet.pt
To: capt_jack-at-mindspring.com
To: sailbad_d_sinner-at-hotmail.com
To: rec.boats.noah-at-earthlink.net
To: aeronaut-at-flight.net
To: piperopiper-at-yahoo.com
To: otnmbrd-at-earthlink.net
To: res1g5v5-at-verizon.net
To: clarkt-at-region.halton.on.ca
To: bradnh-at-volcanomail.com
To: dkanter-at-frontiernet.net
To: cysusenet-at-worldnet.att.net
To: marbisins-at-tampabay.rr.com
To: ksmith1-at-tpg.com.au
To: skoconsult-at-aol.com
To: jim-at-clark.cys
To: doug888-at-bellsouth.net
To: nojunk_n3cvj-at-worldlynx.net
To: ahoy2u-at-aol.com
To: john.gaquin-at-verizon.net
To: j.mcd-at-ns.sympatico.ca
To: r.c.eriksson-at-att.net
To: thunder-at-gti.net
To: qwerty-at-lut.fi
To: dont-at-bother.com
To: kingy-at-capital.net
To: joe-at-privacy.net
To: l4foto-at-aol.com
To: cglocke-at-airmail.net
To: t.thomas-at-mchsi.com
To: gofig-at-mac.com
To: dcecchi-at-msn.com
To: lee-at-thebayguide.com
To: vigilance-at-justice.com
To: theseafox-at-aol.com
To: noyb-at-noyb.com
To: nomail-at-rogers.com
To: lejaynes-at-comcast.net
To: vxmnovxspa-3m*-at-altara.invalid
To: bowgus-at-rogers.com
To: gfretwell-at-aol.comgreg
To: etaoin_shrdlu-at-hotmail.com
To: read-at-sympatico.ca
To: me-at-hyperx.com
To: waynebatrecdotboats-at-hotmail.com
To: meh531-at-hotmail.com
To: jimdotedu-at-yahoo.com
To: vtv001-at-hotmail.com
To: noneofyourbusiness-at-aol.com
To: tonyjvan-at-comcast.net
To: jasonrnorth-at-bigfoot.com
To: markdeb.browne-at-comcast.net
To: jabadoodle-at-yahoo.com
To: nospinzone-at-rec.boats
To: taltmeyer-at-aol.com
To: asad-at-yankeemedia.n3t
To: skcusemans-at-eudoramail.com
To: nharwood-at-tampabay.rr.com
To: trash-at-thedump.com
To: williamcole-at-hotmail.com
To: macomras-at-aol.com
To: white-at-nsknospm.sympatico.ca
To: gould0738-at-aol.com
To: jameslwoodward-at-attbi.com
To: mm0928-at-charter.net
To: graham-at-luna-aromaticsremovethis.com
To: verbrugh-at-cableone.net
To: attorney-at-cybermesa.com
To: carver-at-cam.cornell.edu
To: bruce.limber-at-juno.com
To: trackrunner1500-at-hotmail.com
To: brettz9-at-yahoo.com
To: sb.gerstner-at-ntlworld.com
To: johnludgate-at-doe.asTo: cristinacoelho-at-epar.jazznet.pt
To: doug888-at-bellsouth.net
To: jim-at-clark.cys
To: skoconsult-at-aol.com
To: ksmith1-at-tpg.com.au
To: marbisins-at-tampabay.rr.com
To: cysusenet-at-worldnet.att.net
To: dkanter-at-frontiernet.net
To: bradnh-at-volcanomail.com
To: clarkt-at-region.halton.on.ca
To: res1g5v5-at-verizon.net
To: otnmbrd-at-earthlink.net
To: piperopiper-at-yahoo.com
To: aeronaut-at-flight.net
To: rec.boats.noah-at-earthlink.net
To: sailbad_d_sinner-at-hotmail.com
To: capt_jack-at-mindspring.com


...carry on.
noah

To email me, please remove the "FISH" from the net.

"they" will get tired of it? It's a virus! There isn't some dumbass 16 year
old sending those one at a time. That's the problem.

Dan


Bill wrote:
So THAT's where they're coming from. My email is not on the list but
I have received 200+ virus laden emails since I posted a question last
week.
I have since altered my email address but I am afraid the damage is
done. Oh well, maybe they will eventually get tired of it.

Thanks for the heads up!!

Bill
On 27 Sep 2003 19:46:34 -0500, noah
wrote:


I received a message today, in Portuguese no less, listing my email
address, and a number of others in this group, as having been
harvested by the W32/swenn@mm worm.

The list is not "all inclusive", meaning that you could still be
targeted even if your addy is not listed. I also know that some are
already invalid, or munged, but I am including the entire list that I
received. There are duplicates. I don't know why.

Be aware that this worm will not only target you, but will send virus
emails listing *you* as the sender. You may get irate mail, or
notices from your ISP, that you are sending virii, when you are not.
The smart ISP's filter for viruses. MANY (i.e. Earthlink), do not.

Also be aware that these addresses (your's and mine) can be
"re-harvested" from the worm, and used for other purposes, such as
sending SPAM, trojan viruses, and other nasty stuff. Your account may
also get hacked, as "they" now know the username, they only need to
hack the password.

I really dislike having to munge my address ("...FISH.net"), and it
get's my Irish up to surrender to these *ssholes, but some of you (me,
included) may wish to consider changing your email address, and
munging it. I'm still thinking about it. I will probably wait to see
if this situation "calms down". I am still receiving about 100
viruses a day, and earthlink bounces them after my account hits 10
megabyte.

I have edited this list, to change the "@" in the addresses to "-at-".
No sense in giving the SPAMbots any food.

Good luck:

To: cristinacoelho-at-epar.jazznet.pt
To: capt_jack-at-mindspring.com
To: sailbad_d_sinner-at-hotmail.com
To: rec.boats.noah-at-earthlink.net
To: aeronaut-at-flight.net
To: piperopiper-at-yahoo.com
To: otnmbrd-at-earthlink.net
To: res1g5v5-at-verizon.net
To: clarkt-at-region.halton.on.ca
To: bradnh-at-volcanomail.com
To: dkanter-at-frontiernet.net
To: cysusenet-at-worldnet.att.net
To: marbisins-at-tampabay.rr.com
To: ksmith1-at-tpg.com.au
To: skoconsult-at-aol.com
To: jim-at-clark.cys
To: doug888-at-bellsouth.net
To: nojunk_n3cvj-at-worldlynx.net
To: ahoy2u-at-aol.com
To: john.gaquin-at-verizon.net
To: j.mcd-at-ns.sympatico.ca
To: r.c.eriksson-at-att.net
To: thunder-at-gti.net
To: qwerty-at-lut.fi
To: dont-at-bother.com
To: kingy-at-capital.net
To: joe-at-privacy.net
To: l4foto-at-aol.com
To: cglocke-at-airmail.net
To: t.thomas-at-mchsi.com
To: gofig-at-mac.com
To: dcecchi-at-msn.com
To: lee-at-thebayguide.com
To: vigilance-at-justice.com
To: theseafox-at-aol.com
To: noyb-at-noyb.com
To: nomail-at-rogers.com
To: lejaynes-at-comcast.net
To: vxmnovxspa-3m*-at-altara.invalid
To: bowgus-at-rogers.com
To: gfretwell-at-aol.comgreg
To: etaoin_shrdlu-at-hotmail.com
To: read-at-sympatico.ca
To: me-at-hyperx.com
To: waynebatrecdotboats-at-hotmail.com
To: meh531-at-hotmail.com
To: jimdotedu-at-yahoo.com
To: vtv001-at-hotmail.com
To: noneofyourbusiness-at-aol.com
To: tonyjvan-at-comcast.net
To: jasonrnorth-at-bigfoot.com
To: markdeb.browne-at-comcast.net
To: jabadoodle-at-yahoo.com
To: nospinzone-at-rec.boats
To: taltmeyer-at-aol.com
To: asad-at-yankeemedia.n3t
To: skcusemans-at-eudoramail.com
To: nharwood-at-tampabay.rr.com
To: trash-at-thedump.com
To: williamcole-at-hotmail.com
To: macomras-at-aol.com
To: white-at-nsknospm.sympatico.ca
To: gould0738-at-aol.com
To: jameslwoodward-at-attbi.com
To: mm0928-at-charter.net
To: graham-at-luna-aromaticsremovethis.com
To: verbrugh-at-cableone.net
To: attorney-at-cybermesa.com
To: carver-at-cam.cornell.edu
To: bruce.limber-at-juno.com
To: trackrunner1500-at-hotmail.com
To: brettz9-at-yahoo.com
To: sb.gerstner-at-ntlworld.com
To: johnludgate-at-doe.asTo: cristinacoelho-at-epar.jazznet.pt
To: doug888-at-bellsouth.net
To: jim-at-clark.cys
To: skoconsult-at-aol.com
To: ksmith1-at-tpg.com.au
To: marbisins-at-tampabay.rr.com
To: cysusenet-at-worldnet.att.net
To: dkanter-at-frontiernet.net
To: bradnh-at-volcanomail.com
To: clarkt-at-region.halton.on.ca
To: res1g5v5-at-verizon.net
To: otnmbrd-at-earthlink.net
To: piperopiper-at-yahoo.com
To: aeronaut-at-flight.net
To: rec.boats.noah-at-earthlink.net
To: sailbad_d_sinner-at-hotmail.com
To: capt_jack-at-mindspring.com


...carry on.
noah

To email me, please remove the "FISH" from the net.

Stig Arne Bye wrote:

noah wrote:

snip

After the infected attachment has been removed by Norton AntiVirus (TM),
the remainder (the mail header) is moved to a spesial file. By using
these headers, I can then make a graphic chart (by using a small program
I have made myself) showing how many infected e-mail that has been
received each day, as you can from the following:

E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================== =

Total count: 2337

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 * ####### | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 28.09.2003 at 13:58).


After this, I encountered an increase in infected e-mail received, where
the number of infected e-mail received each day were stable around 150
per day for several days. However, now it finally seem to be a
noticeable decrease as you can see from the last graph generated below
(in fact, I haven't received ANY e-mail infected with the Swen.A worm
for the last about 6 hours).


E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================== =

Total count: 3072

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 ########## | | | | | | | | |
2003.09.29 ################# | | | | | | | | |
2003.09.30 ################ | | | | | | | | |
2003.10.01 ################ | | | | | | | | |
2003.10.02 ############## | | | | | | | | |
2003.10.03 #########| | | | | | | | | |
2003.10.04 * | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 04.10.2003 at 01:26).


BTW, I noticed that the previous mass mailing worm (Sobig.F) was first
discovered on 18th of August, and this last mass mailing worm (Swen.A)
was first discovered on 18th of September.
If the identical dates is an actual pattern, then just wait until
18th of October.....



Stig Arne Bye

E-mail ......:
Contact .....: AOL IM: VT480TFE / MSN: / ICQ: 403349
Snail-Mail ..: P.O.Box 169, NO-9915 Kirkenes, Norway
Homepage ....: http://home.online.no/~stigbye/index.html
------------------------------------------------------------------------
Located just about 70°N 30°E - Almost at the top of the world!