I received a message today, in Portuguese no less, listing my email
address, and a number of others in this group, as having been
harvested by the W32/swenn@mm worm.

The list is not "all inclusive", meaning that you could still be
targeted even if your addy is not listed. I also know that some are
already invalid, or munged, but I am including the entire list that I
received. There are duplicates. I don't know why.

Be aware that this worm will not only target you, but will send virus
emails listing *you* as the sender. You may get irate mail, or
notices from your ISP, that you are sending virii, when you are not.
The smart ISP's filter for viruses. MANY (i.e. Earthlink), do not.

Also be aware that these addresses (your's and mine) can be
"re-harvested" from the worm, and used for other purposes, such as
sending SPAM, trojan viruses, and other nasty stuff. Your account may
also get hacked, as "they" now know the username, they only need to
hack the password.

I really dislike having to munge my address ("...FISH.net"), and it
get's my Irish up to surrender to these *ssholes, but some of you (me,
included) may wish to consider changing your email address, and
munging it. I'm still thinking about it. I will probably wait to see
if this situation "calms down". I am still receiving about 100
viruses a day, and earthlink bounces them after my account hits 10
megabyte.

I have edited this list, to change the "@" in the addresses to "-at-".
No sense in giving the SPAMbots any food.

Good luck:

To: cristinacoelho-at-epar.jazznet.pt
To: capt_jack-at-mindspring.com
To: sailbad_d_sinner-at-hotmail.com
To: rec.boats.noah-at-earthlink.net
To: aeronaut-at-flight.net
To: piperopiper-at-yahoo.com
To: otnmbrd-at-earthlink.net
To: res1g5v5-at-verizon.net
To: clarkt-at-region.halton.on.ca
To: bradnh-at-volcanomail.com
To: dkanter-at-frontiernet.net
To: cysusenet-at-worldnet.att.net
To: marbisins-at-tampabay.rr.com
To: ksmith1-at-tpg.com.au
To: skoconsult-at-aol.com
To: jim-at-clark.cys
To: doug888-at-bellsouth.net
To: nojunk_n3cvj-at-worldlynx.net
To: ahoy2u-at-aol.com
To: john.gaquin-at-verizon.net
To: j.mcd-at-ns.sympatico.ca
To: r.c.eriksson-at-att.net
To: thunder-at-gti.net
To: qwerty-at-lut.fi
To: dont-at-bother.com
To: kingy-at-capital.net
To: joe-at-privacy.net
To: l4foto-at-aol.com
To: cglocke-at-airmail.net
To: t.thomas-at-mchsi.com
To: gofig-at-mac.com
To: dcecchi-at-msn.com
To: lee-at-thebayguide.com
To: vigilance-at-justice.com
To: theseafox-at-aol.com
To: noyb-at-noyb.com
To: nomail-at-rogers.com
To: lejaynes-at-comcast.net
To: vxmnovxspa-3m*-at-altara.invalid
To: bowgus-at-rogers.com
To: gfretwell-at-aol.comgreg
To: etaoin_shrdlu-at-hotmail.com
To: read-at-sympatico.ca
To: me-at-hyperx.com
To: waynebatrecdotboats-at-hotmail.com
To: meh531-at-hotmail.com
To: jimdotedu-at-yahoo.com
To: vtv001-at-hotmail.com
To: noneofyourbusiness-at-aol.com
To: tonyjvan-at-comcast.net
To: jasonrnorth-at-bigfoot.com
To: markdeb.browne-at-comcast.net
To: jabadoodle-at-yahoo.com
To: nospinzone-at-rec.boats
To: taltmeyer-at-aol.com
To: asad-at-yankeemedia.n3t
To: skcusemans-at-eudoramail.com
To: nharwood-at-tampabay.rr.com
To: trash-at-thedump.com
To: williamcole-at-hotmail.com
To: macomras-at-aol.com
To: white-at-nsknospm.sympatico.ca
To: gould0738-at-aol.com
To: jameslwoodward-at-attbi.com
To: mm0928-at-charter.net
To: graham-at-luna-aromaticsremovethis.com
To: verbrugh-at-cableone.net
To: attorney-at-cybermesa.com
To: carver-at-cam.cornell.edu
To: bruce.limber-at-juno.com
To: trackrunner1500-at-hotmail.com
To: brettz9-at-yahoo.com
To: sb.gerstner-at-ntlworld.com
To: johnludgate-at-doe.asTo: cristinacoelho-at-epar.jazznet.pt
To: doug888-at-bellsouth.net
To: jim-at-clark.cys
To: skoconsult-at-aol.com
To: ksmith1-at-tpg.com.au
To: marbisins-at-tampabay.rr.com
To: cysusenet-at-worldnet.att.net
To: dkanter-at-frontiernet.net
To: bradnh-at-volcanomail.com
To: clarkt-at-region.halton.on.ca
To: res1g5v5-at-verizon.net
To: otnmbrd-at-earthlink.net
To: piperopiper-at-yahoo.com
To: aeronaut-at-flight.net
To: rec.boats.noah-at-earthlink.net
To: sailbad_d_sinner-at-hotmail.com
To: capt_jack-at-mindspring.com


....carry on.
noah

To email me, please remove the "FISH" from the net.

I'am mad I didn't make the list but i'm getting these stupid E-mails.

"noah" wrote in message
...
I received a message today, in Portuguese no less, listing my email
address, and a number of others in this group, as having been
harvested by the W32/swenn@mm worm.

The list is not "all inclusive", meaning that you could still be
targeted even if your addy is not listed. I also know that some are
already invalid, or munged, but I am including the entire list that I
received. There are duplicates. I don't know why.

Be aware that this worm will not only target you, but will send virus
emails listing *you* as the sender. You may get irate mail, or
notices from your ISP, that you are sending virii, when you are not.
The smart ISP's filter for viruses. MANY (i.e. Earthlink), do not.

Also be aware that these addresses (your's and mine) can be
"re-harvested" from the worm, and used for other purposes, such as
sending SPAM, trojan viruses, and other nasty stuff. Your account may
also get hacked, as "they" now know the username, they only need to
hack the password.

I really dislike having to munge my address ("...FISH.net"), and it
get's my Irish up to surrender to these *ssholes, but some of you (me,
included) may wish to consider changing your email address, and
munging it. I'm still thinking about it. I will probably wait to see
if this situation "calms down". I am still receiving about 100
viruses a day, and earthlink bounces them after my account hits 10
megabyte.

I have edited this list, to change the "@" in the addresses to "-at-".
No sense in giving the SPAMbots any food.

Good luck:

To: cristinacoelho-at-epar.jazznet.pt
To: capt_jack-at-mindspring.com
To: sailbad_d_sinner-at-hotmail.com
To: rec.boats.noah-at-earthlink.net
To: aeronaut-at-flight.net
To: piperopiper-at-yahoo.com
To: otnmbrd-at-earthlink.net
To: res1g5v5-at-verizon.net
To: clarkt-at-region.halton.on.ca
To: bradnh-at-volcanomail.com
To: dkanter-at-frontiernet.net
To: cysusenet-at-worldnet.att.net
To: marbisins-at-tampabay.rr.com
To: ksmith1-at-tpg.com.au
To: skoconsult-at-aol.com
To: jim-at-clark.cys
To: doug888-at-bellsouth.net
To: nojunk_n3cvj-at-worldlynx.net
To: ahoy2u-at-aol.com
To: john.gaquin-at-verizon.net
To: j.mcd-at-ns.sympatico.ca
To: r.c.eriksson-at-att.net
To: thunder-at-gti.net
To: qwerty-at-lut.fi
To: dont-at-bother.com
To: kingy-at-capital.net
To: joe-at-privacy.net
To: l4foto-at-aol.com
To: cglocke-at-airmail.net
To: t.thomas-at-mchsi.com
To: gofig-at-mac.com
To: dcecchi-at-msn.com
To: lee-at-thebayguide.com
To: vigilance-at-justice.com
To: theseafox-at-aol.com
To: noyb-at-noyb.com
To: nomail-at-rogers.com
To: lejaynes-at-comcast.net
To: vxmnovxspa-3m*-at-altara.invalid
To: bowgus-at-rogers.com
To: gfretwell-at-aol.comgreg
To: etaoin_shrdlu-at-hotmail.com
To: read-at-sympatico.ca
To: me-at-hyperx.com
To: waynebatrecdotboats-at-hotmail.com
To: meh531-at-hotmail.com
To: jimdotedu-at-yahoo.com
To: vtv001-at-hotmail.com
To: noneofyourbusiness-at-aol.com
To: tonyjvan-at-comcast.net
To: jasonrnorth-at-bigfoot.com
To: markdeb.browne-at-comcast.net
To: jabadoodle-at-yahoo.com
To: nospinzone-at-rec.boats
To: taltmeyer-at-aol.com
To: asad-at-yankeemedia.n3t
To: skcusemans-at-eudoramail.com
To: nharwood-at-tampabay.rr.com
To: trash-at-thedump.com
To: williamcole-at-hotmail.com
To: macomras-at-aol.com
To: white-at-nsknospm.sympatico.ca
To: gould0738-at-aol.com
To: jameslwoodward-at-attbi.com
To: mm0928-at-charter.net
To: graham-at-luna-aromaticsremovethis.com
To: verbrugh-at-cableone.net
To: attorney-at-cybermesa.com
To: carver-at-cam.cornell.edu
To: bruce.limber-at-juno.com
To: trackrunner1500-at-hotmail.com
To: brettz9-at-yahoo.com
To: sb.gerstner-at-ntlworld.com
To: johnludgate-at-doe.asTo: cristinacoelho-at-epar.jazznet.pt
To: doug888-at-bellsouth.net
To: jim-at-clark.cys
To: skoconsult-at-aol.com
To: ksmith1-at-tpg.com.au
To: marbisins-at-tampabay.rr.com
To: cysusenet-at-worldnet.att.net
To: dkanter-at-frontiernet.net
To: bradnh-at-volcanomail.com
To: clarkt-at-region.halton.on.ca
To: res1g5v5-at-verizon.net
To: otnmbrd-at-earthlink.net
To: piperopiper-at-yahoo.com
To: aeronaut-at-flight.net
To: rec.boats.noah-at-earthlink.net
To: sailbad_d_sinner-at-hotmail.com
To: capt_jack-at-mindspring.com


...carry on.
noah

To email me, please remove the "FISH" from the net.

On Sun, 28 Sep 2003 08:24:30 GMT, "Wildest Dream"
wrote:

I'am mad I didn't make the list but i'm getting these stupid E-mails.


LOL! Don't be too mad, you're definitely on a list, just not the one
from Portugal. There can be as many "lists" as there are infected
computers.
....carry on.
noah

To email me, please remove the "FISH" from the net.

noah wrote:

I received a message today, in Portuguese no less, listing my email
address, and a number of others in this group, as having been
harvested by the W32/swenn@mm worm.

The list is not "all inclusive", meaning that you could still be
targeted even if your addy is not listed. I also know that some are
already invalid, or munged, but I am including the entire list that I
received. There are duplicates. I don't know why.

Be aware that this worm will not only target you, but will send virus
emails listing *you* as the sender. You may get irate mail, or
notices from your ISP, that you are sending virii, when you are not.
The smart ISP's filter for viruses. MANY (i.e. Earthlink), do not.

Also be aware that these addresses (your's and mine) can be
"re-harvested" from the worm, and used for other purposes, such as
sending SPAM, trojan viruses, and other nasty stuff. Your account may
also get hacked, as "they" now know the username, they only need to
hack the password.

I really dislike having to munge my address ("...FISH.net"), and it
get's my Irish up to surrender to these *ssholes, but some of you (me,
included) may wish to consider changing your email address, and
munging it. I'm still thinking about it. I will probably wait to see
if this situation "calms down". I am still receiving about 100
viruses a day, and earthlink bounces them after my account hits 10
megabyte.

I have edited this list, to change the "@" in the addresses to "-at-".
No sense in giving the SPAMbots any food.

Good luck:

To: cristinacoelho-at-epar.jazznet.pt
To: capt_jack-at-mindspring.com
To: sailbad_d_sinner-at-hotmail.com
To: rec.boats.noah-at-earthlink.net
To: aeronaut-at-flight.net
To: piperopiper-at-yahoo.com
To: otnmbrd-at-earthlink.net
To: res1g5v5-at-verizon.net
To: clarkt-at-region.halton.on.ca
To: bradnh-at-volcanomail.com
To: dkanter-at-frontiernet.net
To: cysusenet-at-worldnet.att.net
To: marbisins-at-tampabay.rr.com
To: ksmith1-at-tpg.com.au
To: skoconsult-at-aol.com
To: jim-at-clark.cys
To: doug888-at-bellsouth.net
To: nojunk_n3cvj-at-worldlynx.net
To: ahoy2u-at-aol.com
To: john.gaquin-at-verizon.net
To: j.mcd-at-ns.sympatico.ca
To: r.c.eriksson-at-att.net
To: thunder-at-gti.net
To: qwerty-at-lut.fi
To: dont-at-bother.com
To: kingy-at-capital.net
To: joe-at-privacy.net
To: l4foto-at-aol.com
To: cglocke-at-airmail.net
To: t.thomas-at-mchsi.com
To: gofig-at-mac.com
To: dcecchi-at-msn.com
To: lee-at-thebayguide.com
To: vigilance-at-justice.com
To: theseafox-at-aol.com
To: noyb-at-noyb.com
To: nomail-at-rogers.com
To: lejaynes-at-comcast.net
To: vxmnovxspa-3m*-at-altara.invalid
To: bowgus-at-rogers.com
To: gfretwell-at-aol.comgreg
To: etaoin_shrdlu-at-hotmail.com
To: read-at-sympatico.ca
To: me-at-hyperx.com
To: waynebatrecdotboats-at-hotmail.com
To: meh531-at-hotmail.com
To: jimdotedu-at-yahoo.com
To: vtv001-at-hotmail.com
To: noneofyourbusiness-at-aol.com
To: tonyjvan-at-comcast.net
To: jasonrnorth-at-bigfoot.com
To: markdeb.browne-at-comcast.net
To: jabadoodle-at-yahoo.com
To: nospinzone-at-rec.boats
To: taltmeyer-at-aol.com
To: asad-at-yankeemedia.n3t
To: skcusemans-at-eudoramail.com
To: nharwood-at-tampabay.rr.com
To: trash-at-thedump.com
To: williamcole-at-hotmail.com
To: macomras-at-aol.com
To: white-at-nsknospm.sympatico.ca
To: gould0738-at-aol.com
To: jameslwoodward-at-attbi.com
To: mm0928-at-charter.net
To: graham-at-luna-aromaticsremovethis.com
To: verbrugh-at-cableone.net
To: attorney-at-cybermesa.com
To: carver-at-cam.cornell.edu
To: bruce.limber-at-juno.com
To: trackrunner1500-at-hotmail.com
To: brettz9-at-yahoo.com
To: sb.gerstner-at-ntlworld.com
To: johnludgate-at-doe.asTo: cristinacoelho-at-epar.jazznet.pt
To: doug888-at-bellsouth.net
To: jim-at-clark.cys
To: skoconsult-at-aol.com
To: ksmith1-at-tpg.com.au
To: marbisins-at-tampabay.rr.com
To: cysusenet-at-worldnet.att.net
To: dkanter-at-frontiernet.net
To: bradnh-at-volcanomail.com
To: clarkt-at-region.halton.on.ca
To: res1g5v5-at-verizon.net
To: otnmbrd-at-earthlink.net
To: piperopiper-at-yahoo.com
To: aeronaut-at-flight.net
To: rec.boats.noah-at-earthlink.net
To: sailbad_d_sinner-at-hotmail.com
To: capt_jack-at-mindspring.com


...carry on.
noah

To email me, please remove the "FISH" from the net.


Thanks for the heads-up, and further proof that you *need* to be using a
virus scanner and other tools to check out your email before you open it.



--
* * *
email sent to will *never* get to me.

Noah:
For newsgroup use, I've switched to using a throwaway hotmail address. But,
the damage is already done to the Frontier address. I'm getting over 4mb of
junk mail each day. Someone in one of the Microsoft newsgroups suggested
that I take a look at a program called K9, at this site:
http://keir.net/

It's not a turnkey solution, but something which requires thinking on the
part of the user. What it does is identify what it believes is spam. For the
first day or two, it'll make a few errors, but that doesn't matter, since it
doesn't delete the spam. It marks the message's subject line with a phrase
which you can select. It then passes the message through to your normal
email program. This makes it a breeze to create a mail rule based on that
word. The default is [spam], but it could be [aunt beatrice] or anything
else. Besides making rules easier to create, it obviously makes sorting a
breeze. And, if it mistakenly marks something as spam, it's easy to "teach"
the program.

I have 4 email accounts, but only my Frontier account is being crippled by
the number of virus-laden emails it's getting. I receive little or no real
mail there anyway, so I've told OE to stop checking it. Then, I use another
feature of K9 called "server check". It goes to your email server and
downloads just the subject headers. It marks them according to whatever
word(s) you've chosen. If they're obviously bad mail, you can select just
those and delete them from the server, leaving only the good ones. Then,
your email client can be manually told to grab messages from that account.

The program's got a few rough edges, but all in all, it works nicely. It's
free, and there are a few MVPs in the newsgroups below who understand it
enough to be helpful.

microsoft.public.windows.inetexplorer.ie6_outlooke xpress
microsoft.public.win98.gen_discussion

Doug

On Sun, 28 Sep 2003 12:41:40 GMT, "Doug Kanter"
wrote:

Noah:
For newsgroup use, I've switched to using a throwaway hotmail address. But,
the damage is already done to the Frontier address. I'm getting over 4mb of
junk mail each day. Someone in one of the Microsoft newsgroups suggested
that I take a look at a program called K9, at this site:
http://keir.net/

It's not a turnkey solution, but something which requires thinking on the
part of the user. What it does is identify what it believes is spam. For the
first day or two, it'll make a few errors, but that doesn't matter, since it
doesn't delete the spam. It marks the message's subject line with a phrase
which you can select. It then passes the message through to your normal
email program. This makes it a breeze to create a mail rule based on that
word. The default is [spam], but it could be [aunt beatrice] or anything
else. Besides making rules easier to create, it obviously makes sorting a
breeze. And, if it mistakenly marks something as spam, it's easy to "teach"
the program.

I have 4 email accounts, but only my Frontier account is being crippled by
the number of virus-laden emails it's getting. I receive little or no real
mail there anyway, so I've told OE to stop checking it. Then, I use another
feature of K9 called "server check". It goes to your email server and
downloads just the subject headers. It marks them according to whatever
word(s) you've chosen. If they're obviously bad mail, you can select just
those and delete them from the server, leaving only the good ones. Then,
your email client can be manually told to grab messages from that account.

The program's got a few rough edges, but all in all, it works nicely. It's
free, and there are a few MVPs in the newsgroups below who understand it
enough to be helpful.

microsoft.public.windows.inetexplorer.ie6_outlook express
microsoft.public.win98.gen_discussion

Doug


Thanks for the info, Doug. I'll give it a look-see.
....carry on.
noah

To email me, please remove the "FISH" from the net.

noah wrote:

snip

I really dislike having to munge my address ("...FISH.net"), and it
get's my Irish up to surrender to these *ssholes, but some of you (me,
included) may wish to consider changing your email address, and
munging it. I'm still thinking about it. I will probably wait to see
if this situation "calms down". I am still receiving about 100
viruses a day, and earthlink bounces them after my account hits 10
megabyte.

I have so far received 2,337 e-mail infected with W32.Swen.A@mm (a.k.a.
Worm.Automat.AHB) since 19th of September. No mail has so far been
bounced as I have 50 MB total POP-account quota at my local ISP and
download e-mail and thus empty the POP-account several times each day.

After the infected attachment has been removed by Norton AntiVirus (TM),
the remainder (the mail header) is moved to a spesial file. By using
these headers, I can then make a graphic chart (by using a small program
I have made myself) showing how many infected e-mail that has been
received each day, as you can from the following:


E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================== =

Total count: 2337

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 * ####### | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 28.09.2003 at 13:58).



Stig Arne Bye

E-mail ......:
Contact .....: AOL IM: VT480TFE / MSN: / ICQ: 403349
Snail-Mail ..: P.O.Box 169, NO-9915 Kirkenes, Norway
Homepage ....: http://home.online.no/~stigbye/index.html
------------------------------------------------------------------------
Located just about 70°N 30°E - Almost at the top of the world!

On Sun, 28 Sep 2003 17:49:20 +0200, Stig Arne Bye
wrote:


I have so far received 2,337 e-mail infected with W32.Swen.A@mm (a.k.a.
Worm.Automat.AHB) since 19th of September. No mail has so far been
bounced as I have 50 MB total POP-account quota at my local ISP and
download e-mail and thus empty the POP-account several times each day.

After the infected attachment has been removed by Norton AntiVirus (TM),
the remainder (the mail header) is moved to a spesial file. By using
these headers, I can then make a graphic chart (by using a small program
I have made myself) showing how many infected e-mail that has been
received each day, as you can from the following:


E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================= ==

Total count: 2337

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 * ####### | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 28.09.2003 at 13:58).



Stig Arne Bye

E-mail ......:
Contact .....: AOL IM: VT480TFE / MSN: / ICQ: 403349
Snail-Mail ..: P.O.Box 169, NO-9915 Kirkenes, Norway
Homepage ....: http://home.online.no/~stigbye/index.html
------------------------------------------------------------------------
Located just about 70°N 30°E - Almost at the top of the world!


Stig, your graph is interesting. I know that I have received
"thousands" as well, but have not been counting. Hopefully, your
graph indicates a "slowdown".

Greetings to Kirkenes, Norway from Albany, New York, USA.
....carry on.
noah

To email me, please remove the "FISH" from the net.

Noah,

The problem with your theory is that you, like me, have a 10MB limit. I've been
getting 100 per day and I would suspect that if we had 50MB available, like
Stig, we would see more.

I'm using the Earthlink Spam Blocker, Netscape 7.X junk filter, and Mc Afee
Online Anti Virus. Even though I am blocking more and more email addresses
every day, new ones keep coming in. Mc Afee only catches a few and those don't
even have the "Swen" virus.

What I am getting are returned emails that I never sent and the MS patches. I
guess there is no way to block the returned emails since they aren't originating
from my computer.

In order to allow "real" email in, I have been cleaning my inbox from the office
through Earthlink Webmail. What a huge waste of time that is.

Good luck,
Dan


noah wrote:
On Sun, 28 Sep 2003 17:49:20 +0200, Stig Arne Bye
wrote:


I have so far received 2,337 e-mail infected with W32.Swen.A@mm (a.k.a.
Worm.Automat.AHB) since 19th of September. No mail has so far been
bounced as I have 50 MB total POP-account quota at my local ISP and
download e-mail and thus empty the POP-account several times each day.

After the infected attachment has been removed by Norton AntiVirus (TM),
the remainder (the mail header) is moved to a spesial file. By using
these headers, I can then make a graphic chart (by using a small program
I have made myself) showing how many infected e-mail that has been
received each day, as you can from the following:


E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================ ===

Total count: 2337

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 * ####### | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 28.09.2003 at 13:58).



Stig Arne Bye

E-mail ......:
Contact .....: AOL IM: VT480TFE / MSN: / ICQ: 403349
Snail-Mail ..: P.O.Box 169, NO-9915 Kirkenes, Norway
Homepage ....: http://home.online.no/~stigbye/index.html
------------------------------------------------------------------------
Located just about 70°N 30°E - Almost at the top of the world!



Stig, your graph is interesting. I know that I have received
"thousands" as well, but have not been counting. Hopefully, your
graph indicates a "slowdown".

Greetings to Kirkenes, Norway from Albany, New York, USA.
...carry on.
noah

To email me, please remove the "FISH" from the net.

The comcast folks are cleaning the stuff as it enters thier server farms.
This means that I am getting 2k per message, not 150K per message.
The current virus-of-the-week does have well defined subject strings. You
can get a list of them from the analysis on the SARC site. Put them in your
blocking rules and forget about it.

Mark Browne -- Can learn from Noah.
Remove the FISH form the net to email me directly.


"Dan Krueger" wrote in message
link.net...
Noah,

The problem with your theory is that you, like me, have a 10MB limit.
I've been
getting 100 per day and I would suspect that if we had 50MB available,
like
Stig, we would see more.

I'm using the Earthlink Spam Blocker, Netscape 7.X junk filter, and Mc
Afee
Online Anti Virus. Even though I am blocking more and more email
addresses
every day, new ones keep coming in. Mc Afee only catches a few and those
don't
even have the "Swen" virus.

What I am getting are returned emails that I never sent and the MS
patches. I
guess there is no way to block the returned emails since they aren't
originating
from my computer.

In order to allow "real" email in, I have been cleaning my inbox from the
office
through Earthlink Webmail. What a huge waste of time that is.

Good luck,
Dan

snip