Doing a small no-no yesterday, I checked my rrmail account at work during lunch- there was a message from Erik Ledbetter.

The enterprise McAfee isolated a variant of the netsky virus. I received a call from IT security telling me that this was a particularly pernicious beast because of the following:

It executed w/o opening the mail message and the virus was in a wav file. The virus eluded the quarantine file.

The IT guys spent three hours isolating this thing. They told me in their opinion, rrmail is not effectively removing viruses and that the sender of the email probably has it.

Erik, sorry to be bearer of bad news. The IT guys suggested you run stinger, adaware and spybot along with AVG.

Netsky, like nearly all the current generation of worms, spoofs the FROM filed in the e-mail. The person whose name appears in the FROM field is not the person who sent it to you. Rather, it's someone who has my e-mail address on their hard drive.

I use virus protection, with e-mail scanning, virus def's updated regularly, and regular hard drive scans--I appreciate the warning but I assure you I'm not the source.

Some other poor sould who has not taken similar precautions is the origin of our problems.

eledbetter@rypn.org

> The IT
> guys suggested you run stinger, adaware and
> spybot along with AVG.

I wonder why they didn't suggest that you stop using virus magnets like Msft IE and OE. I guess that would be too obvious. As long as you use those programs, the virus problems will persist. The so-called anti-virus programs are always one step behind. Caveat Emptor!!


mike211@yknet.ca

I can confirm that in the past hour I've been hit with two "bounce messages" alleging that my e-mail program dispatched Netsky viruses, coming from e-mail addresses I've never seen before but look "railroady". Funny how these anti-virus programs are savvy enough to detect the viruses and supposedly tell me about it, but too dumb to consider that the virus spoofs the "from" address, so replying does no good whatsoever.

For the record, I have three AV programs and a firewall running in harmony. Ain't happening here...

LNER4472-NOSPAM-@bcpl.net

While not related to railroad preservation, I'd suggest that those programs are Virus magnets becasue people use them. If we all switched to something else, we'd create new virus problems. Trust me, as a former UNIX administrator in undergrad, there are a nasty share of viruses, worms, etc in the other stuff as well. We just don't hear about it as much because few people have Sun Solaris workstations as our home computers.

> I wonder why they didn't suggest that you
> stop using virus magnets like Msft IE and
> OE. I guess that would be too obvious. As
> long as you use those programs, the virus
> problems will persist. The so-called
> anti-virus programs are always one step
> behind. Caveat Emptor!!


david.wilkins@bardstown.com

> I wonder why they didn't suggest that you
> stop using virus magnets like Msft IE and
> OE. I guess that would be too obvious. As
> long as you use those programs, the virus
> problems will persist. The so-called
> anti-virus programs are always one step
> behind. Caveat Emptor!!

As official matter, they can't recommend programs outside the "official" programs. As a practicsal matter, they can give admin priveledges to users.

At home, I prefer Mozilla-even though RYPN interchange messages come up underlined. Any other good browsers?

> I wonder why they didn't suggest that you
> stop using virus magnets like Msft IE and
> OE. I guess that would be too obvious. As
> long as you use those programs, the virus
> problems will persist. The so-called
> anti-virus programs are always one step
> behind. Caveat Emptor!!

As official matter, they can't recommend programs outside the "official" programs. As a practical matter, they can give admin priveledges to users.

At home, I prefer Mozilla-even though RYPN interchange messages come up underlined. Any other good browsers?

Are the new electronix in the diesels supceptible to viruses? and if so do you think this poses a serious threat to the life expectancy of thos units and the ability to preserve them for future generations?

In other words fellas better get back to railway preservation discussion before you get an ADMIN! rebuke!

Dan

ADMIN! Rebuke
dsw@insight.com

Netscape 4.7 works real well except with the Strasburg shop services site.

dave

irondave@bellsouth.net

> Are the new electronix in the diesels
> supceptible to viruses?
> Dan

Yes, especially since there is a strong trend to use 'wireless' links back to mainframe systems.

That's the beauty of a steam engine, all it needs is water and heat, no electronics required.

mike211@yknet.ca

> Netscape 4.7 works real well except with the
> Strasburg shop services site.

> dave

Opera works well for me.

mont3682@bellsouth.net

> Opera works well for me.

Also try a different operating system: Linux, Mac, OS/2, etc, but not Windoze.

Or a different mail program (Mozilla, PMMail, Columba, Thunderbird, and turn off the automatic running of scrips, automatic opening of file attachments and images, and disable html formatted mail. Stay away from Outlook in all its variations.

> That's the beauty of a steam engine, all it
> needs is water and heat, no electronics
> required.

That fact was noted by a very senior ex-Burlington engineer on the CZ when his brand new P-32 died on the road because of computer problems. His quote, "That's one good thing about the O-5, you never had to reboot the damn thing."

kevin.r.gillespie@verizon.net

Hi All
I have found that by using a good Anti virus program and an good Firewall most virises dont have much chance. but you have to keep them (AV) updated as often as possible so they can keep up with what is out there.
I have had only one major infection and it was my fault at that. jujst wiped the machine and reinstalled everything.
Andrew Martin
TWVRPS
The Western Virginia Railroad Preservation Society