Running Mozilla Thunderbird 1.5, what should I do if I receive a suspected Kama Sutra worm email?
81412
Do not open up the email, just click on it, and hit the delete button. That will put it in your deleted files..Go to the deleted files list, and delete it again..Or you can use the button, at the top of the page, that says delete..Good Luck..
189666
all you need to know\n\nget the following, all are free for a safe surfing experience,\n\n\nANTI VIRAL\n\nAVG (free) http://free.grisoft.com/\n\n\nFIREWALL \n\nZoneAlarm http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp\n\nWEB BROWSER - http://www.mozilla.org/products/firebird\n\nEMAIL  use thunderbird. It has a good built in spam filter and learns when you teach it. http://www.mozilla.org/products/thunderbird\n\nSPYWARE\n\n http://www.lavasoftusa.com/software/adaware/\n\n http://www.safer-networking.org/en/index.html \n\n\nand if you have a wireless router follow these tips,\n\n\n1. Use WPA encryption (WPA-PSK) it's less crackable then WEP.\n\n2. Make a passphrase that is upper & lower case and has some numbers thrown in there as well, again harder to crack.\nsome like mAkE1t5eCurE0rel53 and as long as possible.\n\n3. Use MAC access control so only you or authorized PC's can connect (even if you do have encryption turned on)\n\n4. Turn off DHCP use static addresses.\n\n5. Turn off SSID (and change it) unless your card really needs it (some do)\n\n6. Change username/password of access unit front end\n\n7. Ensure you have the usual firewall enabled on your PC.\n\n8. Paranoia rules, turn WLAN off if your not using it :)\n\n\none last tip\ncontrol panel---administrator tools--services--messenger\n\nright clik on it\nstop the service\nthen disable it\nsave changes
1106820
it looks like the email was parsing an executable file called love_lorn.kiss.ok.exe ... sounds like a virus!  i wouldn't download the attachment if I were you... sounds like a virus to me
256498
As D-Day for the 'Kama Sutra' worm nears, security firm Sophos is warning users not to panic over the threat posed by it. \n\nThe W32/Nyxem-D worm, which can pose as pictures of the Kama Sutra, has a destructive payload, which triggers half an hour after a computer is booted on the third day of any month, destroying DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP files by replacing their contents with the phrase: \n\nDATA Error [47 0F 94 93 F4 K5] \n\nNyxem-D worm is also known as Blackworm, Email-Worm.Win32.VB.bi, Win32/Mywife.e or W32.Blackmal.E@mm. "When you panic, you make mistakes," said Graham Cluley, senior technology consultant for Sophos. "Sit down, have a cup of tea, and work out if you have done everything you should have done to ensure your computer isn't at risk from the Nyxem worm, and indeed any of the other 120,000 pieces of malware in existence." \n\nThe W32/Nyxem-D Windows worm does not infect Macintosh computers and experts believe that home users may be at more risk than businesses because typically they take security issues less seriously. \n\n"Most businesses have been successfully protecting against this worm for a couple of weeks," said Cluley. "Home users who have not been updating their software may be at risk if they are in the habit of opening unsolicited attachments in emails with dodgy sounding subject lines. Even if they are infected, and do nothing, and the worm demolishes their data on Friday, they should be able to recover if they have a recent backup. Anyone who suffers from this worm's payload simply hasn't been practicing safe computing." \n\nSophos warns that focusing too much on Nyxem's threat on Friday 3 February may leave people unaware of other malware risks. \n\n"The damage caused by W32/Nyxem-D has stirred up the public interest because it sounds really terrible - but in many ways, it is the less visible malicious payloads delivered by other malware which can be far worse," said Cluley. "You may be able to recover the files deleted by Nyxem by going to backup or retyping the content. But you can never get back files which a hacker stole from your PC using a backdoor Trojan. You can never untype keystrokes which were captured by a keylogger. You can never unsend the thousands of emails spammed out if your computer is a zombie." \n\n"Bottom line - if you're worried about Nyxem-D now is the time to look for it, but maybe if you're worried about that you also have reason to be worried about all the other malware out there," said Cluley. "In January we saw 2,312 brand new pieces of malware, that's over 500 every single week." \n\nSophos suggests that computer users who are concerned that they may be at risk ensure that their anti-virus software is properly installed and up-to-date, and that unsolicited email attachments are not opened. Additionally, PC users should ensure that they have patched their computer against the latest Windows security vulnerabilities, and that a client firewall is installed. Backups of valuable data should be routine both inside businesses and at home.
834479
Sounds like a browser hijack. System Restore is useless with malicious software - it actually re-installs it, becaue all the restore points get infected.\n\nBefore attempting to remove malware you must switch off System Restore as back up files will be hiding in there, and it will just restore itself. Go to Start - programs - accessories - system tools - system restore.\nRun your anti virus and anti spyware in Safe Mode. To get into Safe Mode repeatedly press the F8 key after the bios screen loads but before Windows loads. You'll know if you made it because the screen will be at 800 x 600 and your pc will be slow.\n\nThen beef up your security. Its easier to prevent malware getting on to your sytem in the first place rather than trying to remove it. All the following programs are free for personal use;\n\nYou need to install one firewall.\nThe Windows firewall doesn't stop malware on your pc from dialling out. \nhttp://www.zonelabs.com Zone Alarm firewall\nhttp://www.comodogroup.com/  - Comodo security suite.\n\nYou need to install one anti virus;\nhttp://free.grisoft.com/freeweb.php/doc/2/  -AVG anti virus or\nhttp://www.avast.com - Avast Antivirus \n\nYou need all three anti spyware programs;\nhttp://www.ewido.net - AVG(Ewido) anti trojan.\nhttp://www.lavasoft.com - Ad-Aware SE Personal anti adware\nhttp://www.safer-networking.org - Spybot Search and Destroy anti spyware\n\nAnd these are useful utilities;\nShields Up security site; \nhttps://www.grc.com - check your firewall works\nhttp://www.grc.com/optout.htm - grc anti spyware program and info.\n\nhttp://www.mozilla.com/ Firefox web browser and Thunderbird e-mail program.\nhttp://www.opera.com/ Opera web browser\nInstal both these web browsers, turn off javascript on one and use that browser for vising unknown websites. They don't support Active X so thats one less way for problems to get on your pc.\n\nhttp://spywarewarrior.com/rogue_anti-spyware.htm - The Spyware Warrior site identifies fake anti spyware programs.\nhttp://www.ccleaner.com Cr*pcleaner Registry cleaner and privacy tool\nhttp://www.mailwasher.net/ -spam filter\nWinpatrol is a handy utility that tracks cookies on your pc and stops unwanted changes to your startup folder.\nhttp://www.winpatrol.com\nSpywareblaster works with Internet Explorer and Firefox. It won't uninstall spyware that is already on your pc, but it will prevent hijacks and other malicious changes to your browser.\nhttp://www.javacoolsoftware.com\nhttp://www.siteadvisor.com -MacAffee Site Advisor warns about malware on sites you are about to visit.\nhttp://www.sys-shield.com - AbsoluteShield File Shredder\nhttp://heidi.ie/eraser - Eraser file shredder\nhttp://www.softpedia.com/get/Antivirus/Lavasoft-ARIES-Rootkit-Remover.shtml - Aries Rootkit remover.\n\nRemember to update and run all of you anti malware programs at least once a week.
1033491
The article follows. But if you have been receiving these emails: don't open; forward to your abuse@yahoo.com and categorize as spam.\n\nAlso, ensure your virus protector up to date.After you update it, run a COMPLETE scan just to be sure.\n\nAlso, you can set up your virus protection/filters not to allow the title and content of the email to get to your box but to be diverted immediately to SPAM and added to your BLOCK addresses.\n\n-------------------------------\nYahoo, world's most popular e-mail, hit by worm Tue Jun 13, 1:48 AM \n\nLAS VEGAS (Reuters) - Yahoo Inc. (Nasdaq:YHOO - news), the world's \nlargest provider of e-mail services, said on Monday that a software \nvirus aimed at Yahoo Mail users had infected "a very small fraction" \nof its base of more than 200 million accounts. \n\nThe e-mail virus, or worm, has been dubbed Yamanner and landed in \nYahoo mailboxes bearing the headline "New Graphic Site." Once \nopened, the message infects the computer and spreads to other users \nlisted in Yahoo users' e-mail address books, security experts said.\n\nThe e-mail containing the virus need only be opened -- in contrast \nto most worms that are hidden in attachments and require users to \ntake an additional step -- to release the virus, according to \ncomputer security site Symantec Corp. (Nasdaq:SYMC - news).\n\nThe Sunnyvale, California-based company advised users to update \nvirus and firewall software on their computers and to block any e-\nmail sent from the address " av3@...."\n\n"We have taken steps to resolve the issue and protect our users from \nfurther attacks of this worm," Yahoo spokeswoman Kelley Podboy said \nin a statement.\n\n"When we learn of e-mail abuse, such as a worm or other online \nthreat, we take appropriate action," she said. "(A) solution has \nbeen automatically distributed to all Yahoo Mail customers, and \nrequires no additional action on the part of the user."\n\nYamanner, first detected by Yahoo and major computer anti-virus \nsoftware makers earlier on Monday, was ranked as having a low threat \nlevel by Trend Micro Inc. (Nasdaq:TMIC - news) and McAfee Inc. \n(NYSE:MFE - news)\n\nBut Symantec considers the worm an "elevated threat," one step up \nfrom the lowest ranking in terms of relative danger.\n\nSymantec's Security Response site suggested Yahoo Mail users might \nprotect themselves by upgrading to the latest test version of the \nrecently upgraded Yahoo Mail software.\n\n"The worm cannot run on the newest version of Yahoo Mail Beta," \nSymantec's site said.\n\nA Yahoo spokesman was not immediately available to comment on \nwhether the company advised users to do this.\n\nThe worm exploits a vulnerability in Javascript technology used to \nmake the mail program easier to use by triggering embedded HTML \nscripts to run in the computer user's browser.\n\nThe e-mail addresses are also sent to a remote online computer \nserver, which may be used to run spam campaigns, experts said. The \ntechnical name of the worm goes by variants of " JS.Yamanner."
1159868
This page from Symantec states the worm is easily removed and gives steps. The site also says it only attacks Windows systems and can be blocked by upgrading to Yahoo Mail Beta(which seems a little funny to me). It also specifically attacks yahoo mail addresses and yahoo groups from your contacts list. Anyway I hope this helps someone. Here's the URL\n\nhttp://securityresponse.symantec.com/avcenter/venc/data/js.yamanner@m.html
386179
do a virus scan.  \n\nNow.
143974
its prolly the new image virus!\nif the email is unsolicited, then delete it
75632
If you have a web mail address your best option is to use the "mark as spam" function (or something similar).  \n\nHowever, if you use Outlook or Outlook Express (or something like that) you should switch to Mozilla Thunderbird (free, mozilla.com), it will block most of your spam if you use the "mark as junk" feature.  \n\nAlso, if by "addresses that resemble mine" you mean they are  using the same email provider (@ISP_Name.com), using Thunderbird's message filters can usually eliminate all of that type of spam--think "To and CC lines contain (@My_ISP.com) and don't contain (My_Email_Address)". There are also options if your email generally is contained in the To or CC lines.  Just be sure to have it move mail thought as junk to the junk folder, not delete it--although it has NEVER mistaken something that wasn't junk for something that was while I've been using it, it is better to be safe than sorry.\n\nIf all else fails, change your email address and be more careful with it next time.  Make a "spam" yahoo (or other free web mail) account; if a website needs an email address, and you are not sure if they are legitimate, give them your "spam" yahoo account--you can always check it periodically for anything good.
96670
Well, unless you opened an email promising free porn and downloaded the attachment you probably don't have it.  This is how it was spread and propagated itself.  If you are still worried, download a free virus scanner (or update and run the one you have).  If you need one I recommend AVG Free, http://free.grisoft.com/\n\nCan I please assume that you didn't open said email??
235054
IF you have XP use restor in your tool list.and dont sine anymore attachments or spam.Its not yahoo's fault you got a virus.Use a virus remuver program on your PC.
480676
ditch norton\n\nas for the peopel you trust\nthen they are infected and might not know it\n\n\n\nget the following, all are free for a safe surfing experience,\n\n\nANTI VIRAL\n\nAVG (free) http://free.grisoft.com/\n\n\nFIREWALL \n\nZoneAlarm http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp\n\nWEB BROWSER - http://www.mozilla.org/products/firebird\n\nEMAIL  use thunderbird. It has a good built in spam filter and learns when you teach it. http://www.mozilla.org/products/thunderbird\n\nSPYWARE\n\n http://www.lavasoftusa.com/software/adaware/\n\n http://www.safer-networking.org/en/index.html \n\n\nand if you have a wireless router follow these tips,\n\n\n1. Use WPA encryption (WPA-PSK) it's less crackable then WEP.\n\n2. Make a passphrase that is upper & lower case and has some numbers thrown in there as well, again harder to crack.\nsome like mAkE1t5eCurE0rel53 and as long as possible.\n\n3. Use MAC access control so only you or authorized PC's can connect (even if you do have encryption turned on)\n\n4. Turn off DHCP use static addresses.\n\n5. Turn off SSID (and change it) unless your card really needs it (some do)\n\n6. Change username/password of access unit front end\n\n7. Ensure you have the usual firewall enabled on your PC.\n\n8. Paranoia rules, turn WLAN off if your not using it :)\n\n\none last tip\ncontrol panel---administrator tools--services--messenger\n\nright clik on it\nstop the service\nthen disable it\nsave changes
86488
Provided you have av software and antispyware software, which you should have. If you don't have any get some (I have links at the bottom). The worm you are talking about is only going to attack you if you open e-mail attachments. I would suggest though that you run the removal tool from http://www.bitdefender.com/site/Download/downloadRemovalTool/521/1/Antinyxem-EN.exe\nIf you have it, run a scan from http://housecall.trendmicro.com. Then you should be fine. Good luck. Some good utilities to run in case you don't have protection are below (all of them can be used at the same time with no problems), but Ewido is only for Windows 2000 and Windows XP. I would recommend that you download the rest of these though, (execpt Ewido if you don't have XP or 2000_. Good luck
1001600
Hello,\nFirst off, if you are using Yahoo's new Beta email then don't worry, and if not then I would highly recommend it, it is very cool. But now to the virus. Here is the link to the report:\nhttp://cbs5.com/topstories/local_story_164151137.html\nBasiclly Yahoo says they have resolved the issue.\nCheers ...\nRick
627739
That's not showing up in any listing as a virus.  It could just be the name of the person that sent it.  More than likely though, that's the name that the spammer chose to display on his/her emails.  Your friend probably just got spam - it's nothing to worry about as long as you didn't click on any links in the message.
1181655
download\n\nfirefox \n\nand thunderbird\n\nfrom mozilla.com