# WARNING!!! Virus Warning About SD-Related Email!!!! READ NOW!!! **URL:** \ **Category:** Factual Questions\ **Created:** [December 14, 2000, 8:06pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593 "2000-12-14T20:06:43Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![manhattan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/manhattan/32/7_2.png) [@manhattan](https://boards.straightdope.com/u/manhattan)\ **Post date:** [December 14, 2000, 8:06pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/1 "2000-12-14T20:06:43Z")
As many of you know, the Straight Dope Message Board today revoked the posting privileges of the (now former) member known as Jack Dean Tyler. A few minutes ago, the message board staff received an email from an address associated with that former member which we believe contained a virus of some sort. We’re still trying to sort things out to figure out exactly what is going on, but for now, please exercise caution in opening emails from sources not familiar to you. As we are able to share more, we will update you. Please bump this thread from time to time to keep it near the top of the page until we can get the “announcement” function working for us. Thank you. ---
**Author:** ![yabob](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/yabob/32/2821_2.png) [@yabob](https://boards.straightdope.com/u/yabob)\ **Post date:** [December 14, 2000, 8:12pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/2 "2000-12-14T20:12:30Z")
Can you say something about the nature of the virus? Is it an attachment with an .exe, .vb, .doc or other known extension which you would normally exercise caution about opening anyway? Or is it sneakier? ---
**Author:** ![Freyr](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/freyr/32/5763_2.png) [@Freyr](https://boards.straightdope.com/u/Freyr)\ **Post date:** [December 14, 2000, 8:14pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/3 "2000-12-14T20:14:47Z")
If **EVER** you receive an email from an unfamiliar source, treat it like it has a virus, that’s just good sense in today’s inter-connected world! ---
**Author:** ![screech-owl](https://avatars.discourse-cdn.com/v4/letter/s/82dd89/32.png) [@screech-owl](https://boards.straightdope.com/u/screech-owl)\ **Post date:** [December 14, 2000, 8:32pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/4 "2000-12-14T20:32:16Z")
_nudge_ ---
**Author:** ![manhattan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/manhattan/32/7_2.png) [@manhattan](https://boards.straightdope.com/u/manhattan)\ **Post date:** [December 14, 2000, 8:42pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/5 "2000-12-14T20:42:17Z")
I’m sorry, I just don’t know the answer to that, **yabob**. I’m not even sure it was a virus. All I know is that it set both ActiveX and Norton Anti-virus off. It message I got from my Norton was “The virus WScript.KakWorm was detected in an Internet transmission using the BINARY protocol.” And that ActiveX said "“An ActiveX control on this page is unsafe.” We’ll let you know more when/if we’re able. ---
**Author:** ![Kyberneticist](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@Kyberneticist](https://boards.straightdope.com/u/Kyberneticist)\ **Post date:** [December 14, 2000, 8:43pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/6 "2000-12-14T20:43:56Z")
Aside from viruses, while we’re on the discussion of e-mail perils. I can feel fairly smug that I’m running linux, and therefore fairly immune to the usual slew of viruses. However, when using HTML parsing browsers, you can still give away information you may not want to provide. An e-mail can contain cookies, evil javascript, or even applets with stuff like Brown Orifice built in (Netscape 4.72 java security hole). I use a cookie filter (JunkBuster) as well as turning off java and javascript in my mail client. This still leaves the possibility of associating an IP address with my e-mail address through the use of 1x1 invisible gifs. Ah well, use Pine for suspicious e-mails. 🙂 I’m still curious exactly what was meant by “virus” though. ---
**Author:** ![Moirai](https://avatars.discourse-cdn.com/v4/letter/m/96bed5/32.png) [@Moirai](https://boards.straightdope.com/u/Moirai)\ **Post date:** [December 14, 2000, 8:46pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/7 "2000-12-14T20:46:32Z")
bump ---
**Author:** ![Kyberneticist](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@Kyberneticist](https://boards.straightdope.com/u/Kyberneticist)\ **Post date:** [December 14, 2000, 8:51pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/8 "2000-12-14T20:51:50Z")
Before someone corrects me. 🙂 Netscape 4.x security hole. and by 1x1 gifs I mean \ tags which point to a CGI (web bug). Hm. actual content in here while I’m bumping the thread… Are the admins planning on nailing this guy? Me I’d reply to the address (if it is a valid one) and insert one of the aforementioned security compromisers in an e-mail just to get more information (a legal security compromiser, a cookie or web bug). Hey manhattan, give me an e-mail address and I’ll start the hunt. 🙂 ---
**Author:** ![Damhna](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@Damhna](https://boards.straightdope.com/u/Damhna)\ **Post date:** [December 14, 2000, 8:54pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/9 "2000-12-14T20:54:41Z")
AAAAAhhhhhhhhhhhhh Puffffffffffffffffff ---
**Author:** ![Eft](https://avatars.discourse-cdn.com/v4/letter/e/b782af/32.png) [@Eft](https://boards.straightdope.com/u/Eft)\ **Post date:** [December 14, 2000, 9:01pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/10 "2000-12-14T21:01:12Z")
> [@](#): > > \*Originally posted by Kyberneticist \* > Aside from viruses, while we’re on the discussion of e-mail perils. I can feel fairly smug that I’m running linux, and therefore fairly immune to the usual slew of viruses. :shrug: This week. DOS/Windows used to be immune to viruses, too. So did Palm OS. If Linux really catches on, then I can guarantee you that someone will start writing viruses for it. It’s entirely possible that someone has but it hasn’t spread enough to make the news or The Wild List. (I’m not Linux-bashing, just making sure that no one gets the impression that _any_ OS is invulnerable to viruses by design.) I’ll third (fourth?) the recommendation that everyone treat all emails from unknown sources with any kind of attachments as suspicious. If your mail client contains a setting for automatically running ActiveX controls or opening attachments, then for the love of God turn it OFF. ---
**Author:** ![yabob](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/yabob/32/2821_2.png) [@yabob](https://boards.straightdope.com/u/yabob)\ **Post date:** [December 14, 2000, 9:03pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/11 "2000-12-14T21:03:22Z")
If they caught it through Norton, Symantec’s knowledge base has a pretty good info on this one, which I’m sure the SDMB techs are utilizing. For anybody else that was curious, like I was: [http://www.symantec.com/avcenter/venc/data/wscript.kakworm.html](http://www.symantec.com/avcenter/venc/data/wscript.kakworm.html) Another MS Outlook self-propogating scripting worm - the sender may have not even done it intentionally. ---
**Author:** ![Kyberneticist](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@Kyberneticist](https://boards.straightdope.com/u/Kyberneticist)\ **Post date:** [December 14, 2000, 9:07pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/12 "2000-12-14T21:07:30Z")
Agreed. Linux users tend to have a few advantages though: 1. We are usually fairly paranoid about binaries. 2. No linux mail software that I know of runs scripts or binaries outside of a “sandbox” (javascript or java fashion). 3a) Users in linux have traditionally very limited access, viruses can only harm their files, which are generally a small set of system files. 3b) Gaining greater access is generally more difficult, and security holes are often quickly found. 3. Sendmail is easily configured to drop files matching certain patterns. ---
**Author:** ![Scarlett67](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scarlett67/32/7387_2.png) [@Scarlett67](https://boards.straightdope.com/u/Scarlett67)\ **Post date:** [December 14, 2000, 9:24pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/13 "2000-12-14T21:24:32Z")
My turn . . . ---
**Author:** ![teela\_brown](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@teela\_brown](https://boards.straightdope.com/u/teela_brown)\ **Post date:** [December 14, 2000, 9:38pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/14 "2000-12-14T21:38:27Z")
yabob: It’s an attachment showing the extension “.tugahoy” ---
**Author:** ![straykat23](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@straykat23](https://boards.straightdope.com/u/straykat23)\ **Post date:** [December 14, 2000, 9:43pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/15 "2000-12-14T21:43:20Z")
Bump… ---
**Author:** ![Tiburon](https://avatars.discourse-cdn.com/v4/letter/t/e36b37/32.png) [@Tiburon](https://boards.straightdope.com/u/Tiburon)\ **Post date:** [December 14, 2000, 9:56pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/16 "2000-12-14T21:56:53Z")
Nudge, nudge rhymes with fudge. Fudge Fudge’s brother, Peter Peter Peter, pumkin Eater Pumpkin Pie Thanksgiving dinner dinner time lunch time breakfast breakfast sausage eggs chickens barns cows milk cream coffee cake chocolate fudge nudge, nudge ---
**Author:** ![justwannano](https://avatars.discourse-cdn.com/v4/letter/j/7ab992/32.png) [@justwannano](https://boards.straightdope.com/u/justwannano)\ **Post date:** [December 14, 2000, 10:21pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/17 "2000-12-14T22:21:43Z")
Bump ---
**Author:** ![Ike\_Witt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ike_witt/32/283_2.png) [@Ike\_Witt](https://boards.straightdope.com/u/Ike_Witt)\ **Post date:** [December 14, 2000, 11:07pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/18 "2000-12-14T23:07:15Z")
Thanks to the trusty mods, I am sure that this virus from JDT will be cut off (so to speak). ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [December 14, 2000, 11:20pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/19 "2000-12-14T23:20:19Z")
I suppose that ought to read ‘allegedly sent by JDT’. Could be someone using a fake email address of his, its very easy to do. Just input the fake address in the real address return field. Anyway, the message should have a header full of enough info to find out where it really came from, whatever it may be. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [December 14, 2000, 11:22pm UTC](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593/20 "2000-12-14T23:22:27Z")
Virus: Piece of executable code that makes and sends copies of itself. It may or may not have a payload, a destructive section of code that specifically causes problems. But even if it does not, it still ties up so much of your machine in its own self-replication as to crash it. Technically, little of what you get are viruses in this sense. Trojan horse: A malicious piece of code disguised as something else. Most, if not all, of the malicious pieces of code you get by email are in trojan form. Trojans require special activation, meaning you can read the email and be safe as long as you do not view or execute attachments (Executable code can be hidden by giving it a name like ‘foo.jpg.exe’. All you see is ‘foo.jpg’, making you think it’s an image file.) Worm: Made famous by Robert Morris, Jr., worms are programs which reproduce by copying themselves over and over, system to system, using up resources and sometimes slowing down the systems. They are self contained and use the networks to spread, in much the same way viruses use files to spread. Some people say the solution to viruses and worms is to just not have any files or networks. They are probably correct. We would include computers. Logic Bomb: Code which will trigger a particular form of ‘attack’ when a designated condition is met. For instance, a logic bomb could delete all files on Dec. 5th. Unlike a virus, a logic bomb does not make copies of itself. [Next page](https://boards.straightdope.com/t/warning-virus-warning-about-sd-related-email-read-now/45593.md?page=2)