PCWorks: Vir*s or legit?

I recevied the following email on several of my email
accounts. I am pretty
sure these are infected, but my trial of Norton on my new
computer did not
detect any problem with the compressed folder or even if I
mvoed the file to
my desktop.

Do not reply to this message

Dear Customer,

Our robot has fixed an abnormal activity from your IP
address on sending
e-mails.
Probably it is connected with the last epidemic of a worm
which does not
have patches at the moment.
We recommend you to install a firewall module and it will
stop e-mail
sending. Otherwise your account will be blocked until you do
not eliminate
malfunction.

Customer support center robot

Has anyone had confrimation of these are infected?

Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv 
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

Norton like any other AV program, is not optimally set by 
default.  Few are set by default to scan archives/compressed

folders/zip files, etc.

Yours is either not set to scan **ALL FILES**, or if it is,
it 
just can't detect the malware yet.  IF that email is from 
Symantec, or is implying its origin is using Symantec/Norton

software, it would seem to indicate the latter, that they
can't 
detect the malware yet.  You can zip the file and try and
send 
it to me off-list.  (One of our ISP's though may block it 
though).
-Clint

God Bless
Clint Hamilton, Owner
http://www.OrpheusCom
puting.com
http://www.Comput
ersCustomBuilt.com
http://Computer-Hardware-Sales-Consumer-Electronics
-Sales.com

----- Original Message ----- 
From: "Jeff Dougherty"

I recevied the following email on several of my email
accounts. 
I am pretty
sure these are infected, but my trial of Norton on my new 
computer did not
detect any problem with the compressed folder or even if I 
mvoed the file to
my desktop.

Do not reply to this message

Dear Customer,

Our robot has fixed an abnormal activity from your IP
address 
on sending
e-mails.
Probably it is connected with the last epidemic of a worm
which 
does not
have patches at the moment.
We recommend you to install a firewall module and it will
stop 
e-mail
sending. Otherwise your account will be blocked until you do

not eliminate
malfunction.

Customer support center robot

Has anyone had confrimation of these are infected?

Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

Hey Clintster.
I moved the file from the compressed file and right clicked
to scan and it
was still OK.
My assumption is this is something brand new in the wild.
What I can't
figure out is how it got some of my email addresses. I
received about five
of these, all from different senders, but the rest of the
emails were the
same. The emails I received them at are from two different
domain names of
mine. The one domain I've only had for a short time.
Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv 
-----Original Message-----
From: owner-pcworksimagicomm.com [mailto:owner-pcworksimagicomm.com] On
Behalf Of Clint - OrpheusComputing.com &
ComputersCustomBuilt.com

Norton like any other AV program, is not optimally set by 
default.  Few are set by default to scan archives/compressed

folders/zip files, etc.

Yours is either not set to scan **ALL FILES**, or if it is,
it 
just can't detect the malware yet.  IF that email is from 
Symantec, or is implying its origin is using Symantec/Norton

software, it would seem to indicate the latter, that they
can't 
detect the malware yet.  You can zip the file and try and
send 
it to me off-list.  (One of our ISP's though may block it 
though).
-Clint

God Bless
Clint Hamilton, Owner
http://www.OrpheusCo
mputing.com8
----- Original Message ----- 
From: "Jeff Dougherty"

I recevied the following email on several of my email
accounts. 
I am pretty
sure these are infected, but my trial of Norton on my new 
computer did not
detect any problem with the compressed folder or even if I 
mvoed the file to
my desktop.

Do not reply to this message

Dear Customer,

Our robot has fixed an abnormal activity from your IP
address 
on sending
e-mails.
Probably it is connected with the last epidemic of a worm
which 
does not
have patches at the moment.
We recommend you to install a firewall module and it will
stop 
e-mail
sending. Otherwise your account will be blocked until you do

not eliminate
malfunction.

Customer support center robot

Has anyone had confrimation of these are infected?

Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

How do you know for SURE it's malware NOW?  If the possible

malware was an attachment, your ISP or your server could
have 
stripped the malware FROM the file then passed the rest.  My
AV 
software does that.
-Clint

God Bless
Clint Hamilton, Owner
http://www.OrpheusCom
puting.com
http://www.Comput
ersCustomBuilt.com
http://Computer-Hardware-Sales-Consumer-Electronics
-Sales.com

----- Original Message ----- 
From: "Jeff Dougherty"

Hey Clintster.
I moved the file from the compressed file and right clicked
to 
scan and it
was still OK.
My assumption is this is something brand new in the wild.
What 
I can't
figure out is how it got some of my email addresses. I
received 
about five
of these, all from different senders, but the rest of the 
emails were the
same. The emails I received them at are from two different 
domain names of
mine. The one domain I've only had for a short time.
Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv

-----Original Message-----


Norton like any other AV program, is not optimally set by
default.  Few are set by default to scan
archives/compressed
folders/zip files, etc.

Yours is either not set to scan **ALL FILES**, or if it is,
it
just can't detect the malware yet.  IF that email is from
Symantec, or is implying its origin is using
Symantec/Norton
software, it would seem to indicate the latter, that they
can't
detect the malware yet.  You can zip the file and try and
send
it to me off-list.  (One of our ISP's though may block it
though).
-Clint

----- Original Message ----- 
From: "Jeff Dougherty"

I recevied the following email on several of my email
accounts.
I am pretty
sure these are infected, but my trial of Norton on my new
computer did not
detect any problem with the compressed folder or even if I
mvoed the file to
my desktop.

Do not reply to this message

Dear Customer,

Our robot has fixed an abnormal activity from your IP
address
on sending
e-mails.
Probably it is connected with the last epidemic of a worm
which
does not
have patches at the moment.
We recommend you to install a firewall module and it will
stop
e-mail
sending. Otherwise your account will be blocked until you
do
not eliminate
malfunction.

Customer support center robot

Has anyone had confrimation of these are infected?

Jeff
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

Jeff, this is a generated email for the Stration malware.

In past emails it has told users that their
support."put your ISP 
here"."your extension" has detected that your
computer may be infected 
and that you should scan your system. I got one, and I
cleaned it off 
numerous others too.

There is an attachment of an executable as well, and it
inserts nasties 
on it's own or from other infected bots.

My advice: delete it and do a deep scan with Norton.

Peter Kaulback

Jeff Dougherty wrote:
> I recevied the following email on several of my email
accounts. I am pretty
> sure these are infected, but my trial of Norton on my
new computer did not
> detect any problem with the compressed folder or even
if I mvoed the file to
> my desktop.
> 
> Do not reply to this message
> 
> Dear Customer,
> 
> Our robot has fixed an abnormal activity from your IP
address on sending
> e-mails.
> Probably it is connected with the last epidemic of a
worm which does not
> have patches at the moment.
> We recommend you to install a firewall module and it
will stop e-mail
> sending. Otherwise your account will be blocked until
you do not eliminate
> malfunction.
> 
> Customer support center robot
> 
> Has anyone had confrimation of these are infected?
> 
> Jeff
> Intrepid TV Repair
> 717-939-7708
> www.hdtvrepair.tv 
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv 

-----Original Message-----
From: owner-pcworksimagicomm.com [mailto:owner-pcworksimagicomm.com] On
Behalf Of Jeff Dougherty
The next day, Norton detected it. This one must have been
brand new. It was
just odd how I received it at many of my email addresses.

I received the following email on several of my email
accounts. I am pretty
sure these are infected, but my trial of Norton on my new
computer did not
detect any problem with the compressed folder or even if I
mvoed the file to
my desktop.

Do not reply to this message

Dear Customer,

Our robot has fixed an abnormal activity from your IP
address on sending
e-mails.
Probably it is connected with the last epidemic of a worm
which does not
have patches at the moment.
We recommend you to install a firewall module and it will
stop e-mail
sending. Otherwise your account will be blocked until you do
not eliminate
malfunction.

Customer support center robot

Has anyone had confrimation of these are infected?

Jeff
Intrepid TV Repair
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

Jeff, see this page http://securityr
eason.com/news/11/48 for some info.

Peter Kaulback

Jeff Dougherty wrote:
> Jeff
> Intrepid TV Repair
> 717-939-7708
> www.hdtvrepair.tv 
> 
> -----Original Message-----
> From: owner-pcworksimagicomm.com
[mailto:owner-pcworksimagicomm.com] On
> Behalf Of Jeff Dougherty
> The next day, Norton detected it. This one must have
been brand new. It was
> just odd how I received it at many of my email
addresses.
> 
> I received the following email on several of my email
accounts. I am pretty
> sure these are infected, but my trial of Norton on my
new computer did not
> detect any problem with the compressed folder or even
if I mvoed the file to
> my desktop.
> 
> Do not reply to this message
> 
> Dear Customer,
> 
> Our robot has fixed an abnormal activity from your IP
address on sending
> e-mails.
> Probably it is connected with the last epidemic of a
worm which does not
> have patches at the moment.
> We recommend you to install a firewall module and it
will stop e-mail
> sending. Otherwise your account will be blocked until
you do not eliminate
> malfunction.
> 
> Customer support center robot
> 
> Has anyone had confrimation of these are infected?
> 
> Jeff
> Intrepid TV Repair
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

Thanks Peter

Jeff
Intrepid TV Repair
717-939-7708
www.hdtvrepair.tv 

-----Original Message-----
From: owner-pcworksimagicomm.com [mailto:owner-pcworksimagicomm.com] On
Behalf Of Peter Kaulback
Sent: Sunday, April 22, 2007 10:41 PM
To: pcworksimagicomm.com
Subject: Re: UPD...RE: PCWorks: Vir*s or legit?

Jeff, see this page http://securityr
eason.com/news/11/48 for some info.

Peter Kaulback

Jeff Dougherty wrote:
> Jeff
> Intrepid TV Repair
> 717-939-7708
> www.hdtvrepair.tv 
> 
> -----Original Message-----
> From: owner-pcworksimagicomm.com
[mailto:owner-pcworksimagicomm.com] On
> Behalf Of Jeff Dougherty
> The next day, Norton detected it. This one must have
been brand new. It
was
> just odd how I received it at many of my email
addresses.
> 
> I received the following email on several of my email
accounts. I am
pretty
> sure these are infected, but my trial of Norton on my
new computer did not
> detect any problem with the compressed folder or even
if I mvoed the file
to
> my desktop.
> 
> Do not reply to this message
> 
> Dear Customer,
> 
> Our robot has fixed an abnormal activity from your IP
address on sending
> e-mails.
> Probably it is connected with the last epidemic of a
worm which does not
> have patches at the moment.
> We recommend you to install a firewall module and it
will stop e-mail
> sending. Otherwise your account will be blocked until
you do not eliminate
> malfunction.
> 
> Customer support center robot
> 
> Has anyone had confrimation of these are infected?
> 
> Jeff
> Intrepid TV Repair
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================

I have my sites on a VPS. I have pretty much full control
over the server
and the options.
Hopefully someone on this list is familiar with this. Is the
a way to
disable the email relaying function? I have folks trying to
email me and
they get a 550 error if they do not have their email program
set to
'requires authentication'. I would prefer these emails to
come through.
Thank you.

Jeff
Intrepid TV Repair
717-939-7708
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================