Welcome to SecurityForumz.com!
FAQFAQ      ProfileProfile    Private MessagesPrivate Messages   Log inLog in

Is the Swen thing over now?

 
   Security Forums (Home) -> General Discussions RSS
Next:  Virus DB  
Author Message
Big Will

External


Since: Feb 03, 2004
Posts: 129



(Msg. 1) Posted: Sun Feb 08, 2004 11:04 pm
Post subject: Is the Swen thing over now?
Archived from groups: alt>comp>virus (more info?)

Hi everyone. Was wondering if the Swen worm is still heavily in the wild.
I haven't seen many e-mails with my address, and even when I accidently
posted mine and some family's address in usenet, I hadn't received any Swen.
Does this mean we could quit munging for the sake of Swen (although I'll
still continue to munge)?

--
William

If it don't work, hit it.
If it still doesn't work, kick it.
If it works after hitting it and kicking it, then it doesn't matter if
hitting it or kicking it helped, what's important is that it works.

 >> Stay informed about: Is the Swen thing over now? 
Back to top
Login to vote
Don Taylor

External


Since: Oct 06, 2003
Posts: 26



(Msg. 2) Posted: Mon Feb 09, 2004 2:56 am
Post subject: Re: Is the Swen thing over now? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

"Big Will" <SpamWSpamiSpamlSpamlSpamBSpam4SpameSpamvSpaaaaameSpammityrSpam.DeleteThis@nIdontlikeSpametzero.net> writes:
>Hi everyone. Was wondering if the Swen worm is still heavily in the wild.
>I haven't seen many e-mails with my address, and even when I accidently
>posted mine and some family's address in usenet, I hadn't received any Swen.
>Does this mean we could quit munging for the sake of Swen (although I'll
>still continue to munge)?

For me Swen mail is down substantially from what it was. I'm only
averaging about 225 a day now, was 5x that for a while.

ntl, and the handful of domain names it uses, looks like they had a
virulent outbreak of Swen about a week ago, appeared suddenly and
several dozen Swen received from them in bursts every day since, no
sign that repeated requests for them to clean this up have had any
effect thus far.

Anyone have a postal address for the president of prodigy.net.mx?
I looked around a bit and didn't find one. But after their having
bounced every complaint about their Swen spew for the last five
months I thought I would put postage to paper and mail a letter.

I've even been making a bit of progress with getting .jp domains
to clean up, after having figured out how to get some admin email
addresses out of jpnic. But I still haven't figured out how to
get info when it just says that the address range is a subnet of
something else.

Bigpond, BTinternet and Tiscali.it continue flushing Swen at the
speed of connectivity. 6000+ received from them with no sign in
the last five months that they will ever stop this.

44408 Swen (plus some the reporting system didn't count) and counting,

 >> Stay informed about: Is the Swen thing over now? 
Back to top
Login to vote
Big Will

External


Since: Feb 03, 2004
Posts: 129



(Msg. 3) Posted: Mon Feb 09, 2004 2:56 am
Post subject: Re: Is the Swen thing over now? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

What you could do with your IP addresses is run it through
whois.cyberabuse.org. They will check all the whois databases, then if you
want more detail, you could go to the one they say it's under and check
there. Another thing you could try doing for those that bounce your e-mails
is write to the postmaster of that ISP telling them that you're trying to
file a complaint with abuse department and keep receiving bounce. If you
end up on a badmailfrom list, though, as I did for spamming an abuse e-mail
with complaints of Swen on a one-to-one ratio with Swen received from their
ISP, then try using a different e-mail addy or spoof one, so that it'll
bounce back from any initial bounce from postmaster (it might not help, but
it made me feel better, don't know if it was legal though).

--
William

If it don't work, hit it.
If it still doesn't work, kick it.
If it works after hitting it and kicking it, then it doesn't matter if
hitting it or kicking it helped, what's important is that it works.

"Don Taylor" <dont.RemoveThis@agora.rdrop.com> wrote in message
news:W7qdnaUzycqp1rrd4p2dnA@scnresearch.com...
> "Big Will"
<SpamWSpamiSpamlSpamlSpamBSpam4SpameSpamvSpaaaaameSpammityrSpam@nIdontlikeSp
ametzero.net> writes:
> >Hi everyone. Was wondering if the Swen worm is still heavily in the
wild.
> >I haven't seen many e-mails with my address, and even when I accidently
> >posted mine and some family's address in usenet, I hadn't received any
Swen.
> >Does this mean we could quit munging for the sake of Swen (although I'll
> >still continue to munge)?
>
> For me Swen mail is down substantially from what it was. I'm only
> averaging about 225 a day now, was 5x that for a while.
>
> ntl, and the handful of domain names it uses, looks like they had a
> virulent outbreak of Swen about a week ago, appeared suddenly and
> several dozen Swen received from them in bursts every day since, no
> sign that repeated requests for them to clean this up have had any
> effect thus far.
>
> Anyone have a postal address for the president of prodigy.net.mx?
> I looked around a bit and didn't find one. But after their having
> bounced every complaint about their Swen spew for the last five
> months I thought I would put postage to paper and mail a letter.
>
> I've even been making a bit of progress with getting .jp domains
> to clean up, after having figured out how to get some admin email
> addresses out of jpnic. But I still haven't figured out how to
> get info when it just says that the address range is a subnet of
> something else.
>
> Bigpond, BTinternet and Tiscali.it continue flushing Swen at the
> speed of connectivity. 6000+ received from them with no sign in
> the last five months that they will ever stop this.
>
> 44408 Swen (plus some the reporting system didn't count) and counting,
 >> Stay informed about: Is the Swen thing over now? 
Back to top
Login to vote
Tech Zero

External


Since: Feb 09, 2004
Posts: 2



(Msg. 4) Posted: Mon Feb 09, 2004 7:19 am
Post subject: Re: Is the Swen thing over now? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

The voice of "Big Will" drifted in on the cyber-winds,
from the sea of virtual chaos...

> Hi everyone. Was wondering if the Swen worm is still heavily in
> the wild. I haven't seen many e-mails with my address, and even
> when I accidently posted mine and some family's address in usenet,
> I hadn't received any Swen. Does this mean we could quit munging
> for the sake of Swen (although I'll still continue to munge)?


A few variants are still kicking around...
I get at least one a week on my older alias, send by one lowly user who
still hasn't fixed their system. }:8/

--
The Tech Zero, Maxwell C.G. Pollare
 >> Stay informed about: Is the Swen thing over now? 
Back to top
Login to vote
Markus Zingg

External


Since: Mar 19, 2004
Posts: 31



(Msg. 5) Posted: Mon Feb 09, 2004 8:44 am
Post subject: Re: Is the Swen thing over now? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

>Hi everyone. Was wondering if the Swen worm is still heavily in the wild.
>I haven't seen many e-mails with my address, and even when I accidently
>posted mine and some family's address in usenet, I hadn't received any Swen.
>Does this mean we could quit munging for the sake of Swen (although I'll
>still continue to munge)?

I still get a lot. Probably ~30% of the volume it used to be at peak
times.

Markus
 >> Stay informed about: Is the Swen thing over now? 
Back to top
Login to vote
Display posts from previous:   
Related Topics:
nortons subscription thing... - Hi, I use Norton's antivirus plus security and I don't quite understand this subscription thing. how much does this cost? what do u get for your money? thanks for any help.

Interesting thing about Sobig - I notice something interesting about each of the W32/Sobig-F emails that arrive each day to clog my Inbox: while the month and day in the Date field seem to be current, the year is "2001" (though bounces are 2003). I have read several descript...

W32/Swen@MM - Hello i have the W32/Swen@MM virus, i cannot find out how to remove this, i have the neewest virus scanner of norton antivirus, it detects infected email attachments when i get like 1000 emails every day about some patches, how can i remove it??? Jeroe...

Swen? - I'm working on a Win 2000 computer that I think has the Swen virus. However, cannot run the fix tool, or anything else on this computer. Whenever I click on what I feel is a valid program icon, the computer comes back with "Cannot find path or file....

Is Swen the "big one"? - I'm hearing reports of folks getting 279 and up emails containing the Swen virus in one day.
   Security Forums (Home) -> General Discussions All times are: Pacific Time (US & Canada) (change)
Page 1 of 1

 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



[ Contact us | Terms of Service/Privacy Policy ]