New Variant of Gpcode Found

New Variant of Gpcode Found

Secure Home | Search | About
 Anti-Virus Software    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
New Variant of Gpcode Found What's in a Name? 06-09-2008
Posted by What's in a Name? on June 9, 2008, 2:33 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

Has everyone heard about this one?

From ZDNet
"Virus analysts at Kaspersky Lab have intercepted a new variant of
Gpcode, a malicious virus that encrypts important files on an infected
desktop and demands payment for a key to recover the data."

http://blogs.zdnet.com/security/?p=1251&tag=nl.e539

max
--
Virus Removal http://max.shplink.com/removal.html
I block all spam/googlegroupers-you can too!
http://improve-usenet.org/index.html
Change nomail.afraid.org to gmail.com to reply by email.

Posted by VanguardLH on June 9, 2008, 6:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
"What's in a Name?" wrote in

> Has everyone heard about this one?
>
> From ZDNet
> "Virus analysts at Kaspersky Lab have intercepted a new variant of
> Gpcode, a malicious virus that encrypts important files on an infected
> desktop and demands payment for a key to recover the data."
>
> http://blogs.zdnet.com/security/?p=1251&tag=nl.e539
>
> max


NOTE: Inappropriate use of FollowUp-To header was ignored. Original
list of newsgroups was used for this reply.


--- Rant on inappropriate use of the FollowUp-To header ---

Don't use the FollowUp-To header. Posting to, say, 3 newsgroups but
moving replies to just 1 of them or to a completely different one means
you disconnect the visitors of those other 2 (or 3) newsgroups from the
rest of the discussion. If a newsgroup is appropriate for your post
then it is also appropriate for the replies. Or, converserly, if the
continued discussion of your post is not appropriate in all the
newsgroups to which you cross-posted then you should not have posted to
those other newsgroups in the first place. You are using the
FollowUp-To header to move replies to YOUR "home" newsgroup but which
the users of the other newsgroups may not visit. After all, if you
cross-post and include your "home" newsgroup then you'll see all those
replies in your home newsgroup and meanwhile all the other users can
still see the replies in their newsgroup where you decided to also
publish your post.

In http://www.faqs.org/faqs/usenet/primer/part1/, it says, "For a
cross-post, you may want to set the Followup-To: header line to the most
suitable group for the rest of the discussion". Read another way, that
means you disconnect the discussion from all the visitors of the other
newsgroups to which you decided to publish your post. Why did you
publish to those other newsgroups if you are going to yank the
discussion away from those users and perhaps even from the respondents
you were attempting to elicit? It is exasperating to post a reply and
never see it in the newsgroup where you read the original post. If your
post was appropriate for all the groups to which you cross-posted then
why wouldn't those same groups be appropriate for the replies? To yank
away the discussion to your "home" group is rude since that is probably
not the "home" group for your respondents. You wanted replies which may
require further replies but now your respondents no longer see the
thread in the newsgroup that they visit to where you published your
post. Also, the respondents may not know if their reply is appropriate
in the "home" group that you happen to choose. In general, malcontents
and spammers use the FollowUp-To header to hide negative replies to
their flame or spam posts, often sending the replies off to a *.test
newsgroup. Is that the company of users to which you want to be
associated?

There are some cases where FollowUp-To should be used. For example, say
a newsgroup is supposed to only get used for citing the content of a
spam e-mail. Discussions about that spam are not supposed to be
published in that citing newsgroup. Just the exhibits are published
there. If someone wants to discuss that particular spam, their replies
should go into a different newsgroup meant for those discussions. I
believe that is how some of the NANAE newsgroups operate but the
principle may apply elsewhere; however, it is rare few newsgroups where
FollowUp-To is appropriate. For the vast majority of newsgroups,
FollowUp-To is *not* appropriate. If you do not want continue the
discussion in the other newsgroups then don't cross-post over there to
only then use FollowUp-To to yank away the continued discussion. If the
discussion is not appropriate in those other newsgroups then it seems
you have self-nominated your post to be off-topic and hence spam.

If you do use the FollowUp-To header, you are expected per netiquette to
alert the readers of your post that you used that header. Be polite and
add a note (at the start of your post) saying that you used the header
(ex., "WARNING: FollowUp-To was used and points to <newsgroup>". You
might also want to explain why you consider any further discussion in
the other newsgroups is inappropriate despite your rudeness in posting
to those other newsgroups. Many times respondents wonder where their
reply post went because they expect to see it in the group they visited
and where they read your post. Not all NNTP clients alert the user that
the poster used the FollowUp-To header. Think about it: you post to
multiple newsgroups but yank the replies to a different newsgroup than
where your respondents visited, then you need more help and reply to
those replies but which are now only in your "home" newsgroup, but the
respondents won't see their posts nor will they see your replies to them
asking for more help. FollowUp-To is not required when you cross-post
since your "home" newsgroup should be one those that were specified in
the list of newsgroups. You'll watch the discussion in your home
newsgroup and the respondents or lurkers can watch that same discussion
in their own newsgroup. If you don't want replies to show up in all the
newsgroups to which you cross-posted then don't cross-post over there in
the first place!

When crossposting, there are not multiple copies of your post that
wastes bandwidth for each to get them propagated to other NNTP servers
and there aren't multiple copies of your post consuming disk space. A
single copy gets sent to the other NNTP servers and a single copy
resides on each NNTP server with pointers to it to make it show up in
multiple newsgroups. You aren't saving bandwidth or disk space by
redirecting replies for a cross-posted message to a single newsgroup.
You are just being rude to the visitors of the other newsgroups to which
you cross-posted but tried to yank away the discussion.

--- End of rant ---

Posted by What's in a Name? on June 9, 2008, 8:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

On 6/9/2008 6:37 PM, VanguardLH after much thought,came up with this jewel:

Note: a.p.s. removed from reply and follow-up reinstated just for Van
(for maximum confusion)
> "What's in a Name?" wrote in
>
>> Has everyone heard about this one?
>>
>> From ZDNet
>> "Virus analysts at Kaspersky Lab have intercepted a new variant of
>> Gpcode, a malicious virus that encrypts important files on an infected
>> desktop and demands payment for a key to recover the data."
>>
>> http://blogs.zdnet.com/security/?p=1251&tag=nl.e539
>>
>> max
>
>
> NOTE: Inappropriate use of FollowUp-To header was ignored. Original
> list of newsgroups was used for this reply.
>
> --- Rant on inappropriate use of the FollowUp-To header ---
> --- Snip rant ---
> --- End of rant ---

So if you knew I would be checking a.p.s. and not the others, why did
you feel it necessary to rant in all 3 groups?

i still have a lot to learn. Will multi-post more in the future.
See you then.
--
Virus Removal http://max.shplink.com/removal.html
I block all spam/googlegroupers-you can too!
http://improve-usenet.org/index.html
Change nomail.afraid.org to gmail.com to reply by email.

Posted by VanguardLH on June 10, 2008, 12:13 am
If you were  Registered and logged in, you could reply and use other advanced thread options
"What's in a Name?" wrote in

NOTE: Original newsgroups in reply were reinstated to maintain access to
this discussion in the newsgroups to which the author chose to include
his discussion.

> VanguardLH wrote:
>
> Note: a.p.s. removed from reply and follow-up reinstated just for Van
> (for maximum confusion)
>>
>> "What's in a Name?" wrote:
>>
>>> <link to article about encrypted malware>
>>
>> NOTE: Inappropriate use of FollowUp-To header was ignored. Original
>> list of newsgroups was used for this reply.
>>
>> --- Rant on inappropriate use of the FollowUp-To header --- --- Snip
>> rant --- --- End of rant ---
>
> So if you knew I would be checking a.p.s. and not the others, why did
> you feel it necessary to rant in all 3 groups?

So all visitors to the other groups from which you yanked away the
discussion would know what happened, and so you couldn't hide the
negative reply regarding your behavior which is typical of spammers and
malcontents. I doubt you want to be likened to those types of users.

YOU were the one that chose that the groups to which you cross-posted
were related to each other regarding the topic of your post. I wasn't
arguing with your choice of groups, only in your choice to use the
FollowUp-To header to hide any continued discussion.

Apparently now your decision is that alt.privacy.spyware was not an
appropriate group to include your discussion. That again was YOUR
choice as to which groups are appropriate for your discussion. However,
in your reply, you included 2 groups but again attempted to force follow
ups to only 1 group and thus rudely yank the conversation away from
those you chose to expose your post in the other group, so I again
reinstated the original groups (as per YOUR decision in your reply) and
ignored your lame attempt to use FollowUp-To.

> i still have a lot to learn. Will multi-post more in the future. See
> you then.

Multi-posting isn't the solution, either. Cross-post when the
newsgroups are related (usually keeping the count to under 4) but do
NOT use the FollowUp-To header. If you cross-post to a newsgroup, YOU
have deemed your discussion is appropriate over there, so don't be rude
by yanking that discussion away from those you impinged with your post
in trying to elicit responses from over there. If later it is deemed
that your discussion is off-topic, you can always change the Newsgroups
header to omit the unrelated group - but whether you use FollowUp-To or
change the Newsgroups header, you should notify of such in the body of
your post (which you did in your reply - sort of).

However, thanks for the heads up on the link to the article. It's a bit
terse to do anything about it or to provide any direction for a user to
commit protections against it, so it will be interesting to see what
comes of it.

Posted by What's in a Name? on June 10, 2008, 1:14 am
If you were  Registered and logged in, you could reply and use other advanced thread options

On 6/10/2008 12:13 AM, VanguardLH after much thought,came up with this
jewel:

Note: I'm sure there will be more rants to follow.....a.s.p. added back
for anyone who cares.
> "What's in a Name?" wrote in
>
> NOTE: Original newsgroups in reply were reinstated to maintain access to
> this discussion in the newsgroups to which the author chose to include
> his discussion.

I got it the first time. I'm sorry you have a sense of humor.
>
>> VanguardLH wrote:
>>
>> Note: a.p.s. removed from reply and follow-up reinstated just for Van
>> (for maximum confusion)
>>> "What's in a Name?" wrote:
>>>
>>>> <link to article about encrypted malware>
>>> NOTE: Inappropriate use of FollowUp-To header was ignored. Original
>>> list of newsgroups was used for this reply.
>>>
>>> --- Rant on inappropriate use of the FollowUp-To header --- --- Snip
>>> rant --- --- End of rant ---
>> So if you knew I would be checking a.p.s. and not the others, why did
>> you feel it necessary to rant in all 3 groups?
>
> So all visitors to the other groups from which you yanked away the
> discussion would know what happened, and so you couldn't hide the
> negative reply regarding your behavior which is typical of spammers and
> malcontents. I doubt you want to be likened to those types of users.

I misunderstood the use of the follow-up and therefore misused it.
I wasn't hiding anything....would you like me to include a.u.k. for you?
They might enjoy your ranting. Your like a woman-give em a word and they
hand you back a story.
>
> YOU were the one that chose that the groups to which you cross-posted
> were related to each other regarding the topic of your post. I wasn't
> arguing with your choice of groups, only in your choice to use the
> FollowUp-To header to hide any continued discussion.
>
> Apparently now your decision is that alt.privacy.spyware was not an
> appropriate group to include your discussion. That again was YOUR
> choice as to which groups are appropriate for your discussion. However,
> in your reply, you included 2 groups but again attempted to force follow
> ups to only 1 group and thus rudely yank the conversation away from
> those you chose to expose your post in the other group, so I again
> reinstated the original groups (as per YOUR decision in your reply) and
> ignored your lame attempt to use FollowUp-To.

I didn't attempt anything
>
>> i still have a lot to learn. Will multi-post more in the future. See
>> you then.
>
> Multi-posting isn't the solution, either. Cross-post when the
> newsgroups are related (usually keeping the count to under 4) but do
> NOT use the FollowUp-To header. If you cross-post to a newsgroup, YOU
> have deemed your discussion is appropriate over there, so don't be rude
> by yanking that discussion away from those you impinged with your post
> in trying to elicit responses from over there. If later it is deemed
> that your discussion is off-topic, you can always change the Newsgroups
> header to omit the unrelated group - but whether you use FollowUp-To or
> change the Newsgroups header, you should notify of such in the body of
> your post (which you did in your reply - sort of).

It was humor- but you didn't get it
>
> However, thanks for the heads up on the link to the article. It's a bit
> terse to do anything about it or to provide any direction for a user to
> commit protections against it, so it will be interesting to see what
> comes of it.

I don't think a solution will be found soon....
--
Virus Removal http://max.shplink.com/removal.html
I block all spam/googlegroupers-you can too!
http://improve-usenet.org/index.html
Change nomail.afraid.org to gmail.com to reply by email.

Similar ThreadsPosted
Gpcode.ak encryptor virus June 17, 2008, 6:31 pm
Re: New variant? July 1, 2008, 9:09 am
Another Mytob variant November 27, 2005, 8:56 am
New variant of Feebs January 25, 2006, 6:20 pm
New Haxdoor Variant August 13, 2006, 9:11 pm
Key Logger variant? November 5, 2006, 10:09 pm
New Storm variant? September 6, 2007, 11:00 am
Newer Mytob variant September 7, 2005, 12:42 pm
Re: Newer Mytob variant September 7, 2005, 2:53 pm
New email worm variant February 6, 2007, 12:59 pm

The site map in XML format XML site map

Contact Us | Privacy Policy