Prev: Multiple epmap TCP connections established with one XP client
Next: hacktool.rootkit
From: David H. Lipman on 1 Jul 2005 17:47
From: "roberto" <ralplavner(a)HotPOP.com>

| Perhaps i should quit this....or maybe get a better lessons of English LOL
|
| Im not worried about getting infected....i have not problem with this....im
| concerning about this: HotPOP.com is afected by Mytob worm . Im receiving
| some messages from support(a)hotpop.com webmaster(a)hotpop.com with the known
| subjects YOUR PASSWORD HAS SUCESFULLY CHANGED...among others. I configured
| my OE to acccess to this account on HotPOP using the POP services this site
| offers...but now that i know the site is afected by mytob i "tried" to save
| my messages and save me in some way ...in a future....changing the feature
| of POP service for a FORWARDING Service. So, i used a yahoo account with POP
| option i have on www.yahoo.com.mx as a filter. If Hotpop site is afected
| then all the messages i receive THERE will be automatically infected??? So,
| then Yahoo will delete my messages....
|
| I think i will lost part of my e -mails.....trying to made the good
| thing...


I think you may find that the email from addresses are forged.

This is a well known Social Enginerring trick to to get yuou infected by making it seem like
it came from a legitimate source.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


From: N. Miller on 2 Jul 2005 02:33
On Fri, 1 Jul 2005 19:39:51 -0400, roberto wrote:

> Im not worried about getting infected....i have not problem with this....im
> concerning about this: HotPOP.com is afected by Mytob worm . Im receiving
> some messages from support(a)hotpop.com webmaster(a)hotpop.com with the known
> subjects YOUR PASSWORD HAS SUCESFULLY CHANGED...among others. I configured
> my OE to acccess to this account on HotPOP using the POP services this site
> offers...but now that i know the site is afected by mytob i "tried" to save
> my messages and save me in some way ...in a future....changing the feature
> of POP service for a FORWARDING Service. So, i used a yahoo account with POP
> option i have on www.yahoo.com.mx as a filter. If Hotpop site is afected
> then all the messages i receive THERE will be automatically infected??? So,
> then Yahoo will delete my messages....

So you will have your HotPOP email forwarded to Yahoo! Mail, Mexico. I
don't know if yahoo.co.mx works exactly like yahoo.com. What I have with a
yahoo.com account is SpamGuard, and the Yahoo! AV program. Yahoo! AV is
strictly hit or miss. When it hits, it only catches viral email, and you
get a notice akin to this:

--------------------------------------
|From: "SBC Yahoo! Mail Virus Protection <***-***@yahoo-inc.com>"
|To: ***@pacbell.net
|Date: Mon, 06 Dec 2004 10:48:55 -0800
|Subject: "Alert: Virus Detected but not Cleaned - Attachment Removed" [E-mail technical support warning.]
|MIME-Version: 1.0
|Content-Type: multipart/mixed;
| boundary="0-1127678671-1102359134-52518"
|
|--0-1127678671-1102359134-52518
|Content-Type: text/plain; charset=us-ascii
|Content-Id:
|Content-Disposition: inline
|
|"Your SBC Yahoo! Mail Virus Protection detected the virus '"W32.Beagle.M(a)mm"' in
|the file '"Information.pif"', attached to the enclosed email message. We scanned
|the file using Norton AntiVirus but were unable to clean it. Therefore, we
|removed the content of the attachment from the message. Please contact the
|message sender if you want to receive the attachment. They must clean the file
|and resend it before we can deliver it to you safely.
|
|"
|
|"SBC Yahoo! Mail successfully cleans most infected attachments, which protects
|you from viruses.
|"
|
|--0-1127678671-1102359134-52518
|Content-Type: message/rfc822
|
|{Original message here; viral attachment was stripped. I removed the entire
| message because it isn't interesting.}
--------------------------------------

When it doesn't work, the viral message is delivered unaltered. I know
because my MTA POPs the pacbell.net accounts on pop.pacbell.yahoo.com. My
MTA runs its own virus check, and catches what Yahoo! Mail misses.

The other feature of yahoo.com is "SpamGuard". It is a trainable filter
which routes email either to "Inbox", or "Bulk" folders. If you aren't
downloading the "Bulk" folder contents, you need to check the web interface
from time to time to see if any goodmail landed in the "Bulk" folder. Any
goodmail in the "Bulk" folder should be opened; this reveals a "This is not
spam" button. Click on the button and the message will automatically be
moved to your "Inbox", and the SpamGuard filters updated.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint
First  |  Prev  | 
Pages: 1 2 3 4
Prev: Multiple epmap TCP connections established with one XP client
Next: hacktool.rootkit