virus trick??? or hopeful n00b??
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: virus trick??? or hopeful n00b??

  1. #1
    Member
    Join Date
    Feb 2004
    Posts
    36

    virus trick??? or hopeful n00b??

    I was passing on the wonderful aspects of this great website when discussions at work started up about email. A co-worker sent me the following. I am not sure if it holds water and wanted to get some "knowledgeable" advise.

    Thanks everybody!

    {quote
    Virus Trick

    This won’t stop a virus from getting into your computer, but it will prevent it from using your address book to spread further, and will also alert you to the fact that the worm has entered your system.

    · Open your address book and click on “new person” or “new contact” just as you would if you were adding someone new to your list of addresses.
    · In the field where you would type the person’s first name, enter “!000” (an exclamation mark followed by three zeroes).
    · In the field where it prompts you to enter the new e-mail address, type in “WormAlert.”
    · Complete the process by clicking “Add,” “Enter,” “OK,” etc.

    How and why this will work:
    The “name” !000 will be placed at the top of your address book as the first entry. This is where a worm will start in an effort to send itself to all of your contacts. When it tries to send itself to !000, however, it will be undeliverable because of the phony e-mail address you entered (WormAlert). When the first attempt to spread the virus fails (which it will because of the phony address), the worm goes no further and won’t spread to your friends and infect their computers.
    The second advantage to this trick is that when you send an e-mail that can’t be delivered you will be notified of a failed attempt in your inbox almost immediately. Hence, if you ever receive an e-mail indicating that a message addressed to WormAlert could not be delivered, you will know right away that you have a virus in your system and can take the appropriate steps to get rid of it.
    quote}

    Not sure about the "worm goes no farther" part. Either way it is an interesting take on getting warned about a worm in your box.

  2. #2
    Yes, that is workable theory. Why? Because all it is merely using fake email to generate an alert for you in your INBOX. The message user WormAlert is not a valid email, so the server reports the error to you in your inbox.

    However, not all worms stop if just the first email address is fscked. Many will simply send to the entire contacts list, not worrying about failed sends. Because keep in mind, that most email based worms are not concerned with checking to see if it was in fact successful, but follows the simple instructions of "Send and move on" without checking.

  3. #3
    Member
    Join Date
    Feb 2004
    Posts
    36
    Thanks.
    your tao is much appreciated.
    I was along the same pattern of thought.

  4. #4
    Senior Member
    Join Date
    May 2003
    Posts
    159
    A good trick to get notified if the worm has tried to send mass mails using your address book.

    I guess otherwise if you disalbe autosend option in your Outlook you can achieve a still better security. Hence everytime it would require you to manually send the mails.. I guess this can actually help to stop the Worm from sending mass mailers..... And clicking on Send/ Receive manually is a very simple process and does not take any of users time...... I am not sure of its effectiveness but just a thought that crossed my mind.....
    ****** Any man who knows all the answers most likely misunderstood the questions *****

  5. #5
    Member
    Join Date
    Feb 2004
    Posts
    36
    Actually, all this (previous posts) was prompted by my email aco**** auto-sending several emails to the same 6-8 people with the same content. Some of which was over a year old. After the great help on this site and a couple of emails to earthlink, i found out that it was a combination of a cult.b virus that was well embedded and the fact that the email version i was using had a bad habit of corrupting messages. This corruption actually caused the emails to be sent over and over. It would happen every 10 days or so.
    Anyway, all that is taken care of. I am not sure if I even have an auto-send feature on my account. I looked to see if that was what was causing my issues and never came across that feature. But good idea. It would not take much more time to click the YES on a send confirmation.

    C' ya,

  6. #6
    Senior Member
    Join Date
    May 2003
    Posts
    159
    Send / Receive settings are available under Mailsetup under Outllook....

    I am attaching the image of the menu .... I guess if we unselect the automatic send features your problem can be solved.......

    See if this helps you.......
    ****** Any man who knows all the answers most likely misunderstood the questions *****

  7. #7
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Seems rather pointless to me, "the horse has already bolted"?

    htp://www.internals.com

    Mail Control by Yariv Kaplan.

    The best thing to do is to stop the thing sending any mails at all? Your friends will love you for it

    Cheers
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  8. #8
    Junior Member
    Join Date
    Feb 2004
    Posts
    12
    I'd change the email address name to,

    congradulations_you_were_pwnd

  9. #9
    The Doctor Und3ertak3r's Avatar
    Join Date
    Apr 2002
    Posts
    2,744
    To further what nihil has said:

    This "trick" is old, is not reliable.. and as most Virii nolonger use outlook or outlook express as their SMTP engine ie they use their own SMTP engine.. this won't work at all.
    Secondly: as many virii now Harvest addresses from your existing emails as well as other documents including stored web pages the trick fails misserably..

    I thought this "trick" was listed on one of the Hoax sites.. just can't find it right now..

    Cheers

    edit: Found it: Visit this page: Bloody good site to have bookmarked I will have to list it on my webpage..
    http://hoaxinfo.com/virusprevent.htm
    "Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr

  10. #10
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,883
    Yes, it was on a hoax site.

    Again. Virus/worm writers are well aware of this and like others have said, the selection of random unchecked addresses will certainly not be hindered by this "trick".

    Now, off to watch netsky.c pound on my SMTP servers...
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •