[Ansteorra] Re: [Ansteorra-announce] Important plea from the Ansteorra admins...

[Armand Dragonetti]

Likewise, I am receiving multiple messages with this same worm and would ask
that everyone please heed Master Pug's request. (quoted below) I would like
to offer a few details that might be helpful in identifying one of the
infected systems.

My thoughts are that someone of a relatively high muckity-muck status is
infected. The worm picks addresses out of one's address book to claim who it
is FROM and picks another one to send it TO. I've received the message
claiming to be from chirugeon at sca.org and webminister at trimaris.org as well
as several other high-level addresses. And I've received them to my
dragonetti at generich.com and kingdomcalendar_vscribe at ansteorra.org accounts.
How many people have
kingdomcalendar_vscribe at ansteorra.org in their address book? Kingdom
officers and/or kingdom server folks (past and present) like Master Pug,
Mistress Clarissa, Ches, Afan, Master Richard, possibly Arabella (left over
from Kingdom Calendar days)...somebody in there could possibly be infected.

So I urge everyone who might have kingdomcalendar_vscribe at ansteorra.org in
their address book, or even those who've just sent a calendar link request
to that address, to please follow Master Pug's advice quoted below. I
suspect relatively few of us have chirugeon at sca.org in our address book as
well, or have sent a message to that person. No matter, I'm just trying to
do what I can to minimize the spread of this worm.

* PLEASE understand that I am not trying to point the finger, cast blame, or
hurl innuendos about. I truly just want to see a reduction in the number of
infected emails that I receive.

If you do find that your system is infected, I'd love to hear about it
privately so I can crucify you in public, wait...I meant so I can stroke my
own ego for the brilliance of my sleuthing :-)

Armand Dragonetti
Virtual Scribe for the Kingdom Calendar

----- Original Message -----
From: "Pug Bainter" <serveradmin at ansteorra.org>
To: <ansteorra-announce at ansteorra.org>
Sent: Wednesday, May 15, 2002 8:49 AM
Subject: [Ansteorra-announce] Important plea from the Ansteorra admins...


> Good Morning,
>
> IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT:
IMPORTANT:
> IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT:
IMPORTANT:
>
>   Do not think that this message is not aimed at you until you have done
>   as I request below.
>
> IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT:
IMPORTANT:
> IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT: IMPORTANT:
IMPORTANT:
>
>   Because of the rampant nature of the current strains of virus within
>   the SCA community in this Kingdom, I am sending this message. I
>   encourage all of you, if not getting on my knees to plea, that each of
>   you:
>
> - Get virus software installed
> - Update your virus software to the latest version
> - Update your virus definitions to the lastest version
> - Setup the automated download of virus definitions
>   - I recommend no less than once a week, and once a day if possible.
>
>   I am receiving several hundred virus postings a week to the different
>   mailing lists, my personal mail and people trying to figure out what
>   can be done about the current virus issues. This does not include the
>   mailing lists that I do not maintain, nor the issues that other
>   individuals are having to deal with. The current outbreak is very
>   annoying to try to track back to any particular individual in most
>   cases because of how it forges the headers.
>
>   Normally virii are not a big deal since the outbreaks only last a few
>   days, in this partiuclar case we've had an outbreak going on for 3
weeks.
>   Because of this, I decided it best to send a remdinder about where to
>   get the more peopular virus software from. You can read moe about the
>   particular strain at that is driving us all crazy at:
>
> http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html
>
>   which includes a removal tool and instrucations on how to remove it
>   manually. McAfee has similar information on their website as well.
>
> ----
> Anti-Virus vendors:
>
> http://www.mcafee.com
(http://www.mcafee.com/centers/anti-virus/)
> http://www.symantec.com             (http://www.symantec.com/avcenter/)
> http://www.f-secure.com             (http://www.f-secure.com/virus-info/)
> http://www.windriver.com/virus/index.htm
>
>
> A good "how-to" for safe email practices:
>
> http://ntbugtraq.ntadvice.com/safemail.asp
> -----
>
>   Remember if you get an attachment or weblink from someone that you
>   are not suspecting, do not open it. Verify what the person sent you
>   was meant for you and what the content is before opening it.
>
>   I hope this information has been useful to you and you will use it
>   wisely.
>
> Sincerely,
>
> --
> Phelim "Pug" Gervase   | "I want to be called. COTTONTIPS. There is
something
> Bryn Gwlad - Ansteorra |  graceful about that lady. A young woman bursting
with
> Dark Horde Moritu      |  vigor. She blinked at the sudden light. She
writes
> pug at pug.net            |  beautiful poems. When ever shall we meet again?"
>   Note: The views do not reflect the SCA nor the Kingdom of Ansteorra.