Terry Wendt we have a problem

Donny Hinson · Post by **Donny Hinson** » 15 Apr 2003 7:30 am

I've suggested this before...

Stop using Microsoft Outlook and 99% of your e-mail "problems" will go away. Is it really worth all that hassle just to have an "address book", and drag and drop whatever?

Not to me.

Jim Phelps · Post by **Jim Phelps** » 15 Apr 2003 7:36 am

True. The viruses get Outlook Express too. If anyone uses it, they should at least go to Tools/Options/Read and UNCHECK the box beside the line that says "automatically download message when viewing in the preview pane". Best to just get antivirus software, or use Netscape or something else.

Kevin Hatton · Post by **Kevin Hatton** » 15 Apr 2003 8:06 am

I HAVE Norton AntiVirus active on my email. I still got the spam loop. How do you explain that?[This message was edited by Kevin Hatton on 15 April 2003 at 09:06 AM.]

Richard Sinkler · Post by **Richard Sinkler** » 15 Apr 2003 8:06 am

Donny, I don't use Outlook Express and still have been flooded. I only have my AOHell book. So i'm sure it 's not just picking on outlook express. Now I'm not attacking you on this, so don't take it wrong. Just some info.

------------------
Carter D10 9p/10k
Richard Sinkler

Jim Phelps · Post by **Jim Phelps** » 15 Apr 2003 8:11 am

Kevin, an antivirus program detects the viruses attached to the emails, if you've got it set for email protection. Do you? If you do, then it's catching the viruses and alerting you to them, right? That's what antivirus programs do. They DON'T have ESP and know who's going to send you an email with a virus and then block their emails.

That means even with antivirus software you'll still receive emails with viruses but if you've configured the software properly it will catch them and alert you to them and not let you open them, and prevent them from being run on your computer.

Richard, no matter what email program or antivirus software you use, you'll still receive them. You can't stop people from emailing you. Outlook Express is dangerous because of the "automatically download messages in preview pane" default setting, which automatically opens viruses, which I posted above about unchecking.[This message was edited by Jim Phelps on 15 April 2003 at 09:31 AM.]

Marco Schouten · Post by **Marco Schouten** » 15 Apr 2003 9:00 am

This is not a virus, any decent virus would mail itself again, however all the mails I received are clean.
I see a different thing: If I choose to answer the mail from Terry, the return adress is subscriptions@pedalsteel.us, however the mails I received were sent to PedalSteel.us@theearlydays.com, which I think is the e-mail adress of Terry's e-mail list, thereby sending itself to everyone on the list.
Don't know why others have a different return adress.

------------------
Steelin' Greetings
Marco Schouten
Sho-Bud Pro III Custom; Sho-Bud LLG; John Pearse bar; Emmons bar; Panther amp

Mike Perlowin RIP · Post by **Mike Perlowin RIP** » 15 Apr 2003 9:04 am

I'm getting all the E-mails too.

Jim Phelps · Post by **Jim Phelps** » 15 Apr 2003 9:22 am

Drew's original post said the emails were coming from Terry but using his email address, that's typical virus behavior, but then again it's probably not impossible (though unlikely) that a bug in Terry's computer could do it without a virus. It sounds like two separate things could be going on, maybe even two viruses. The fact the Hotmail doesn't get the mailings supports the possibility of a virus, since Hotmail has automatic virus scanning. If people are also getting mailings without a virus attached, that could still be a virus. In the past I've received identical emails, one with a virus and one without. I'm not getting the emails mentioned, probably because I changed my email address and they're going to the old email address and being rejected. [This message was edited by Jim Phelps on 15 April 2003 at 10:22 AM.]

Ken Byng · Post by **Ken Byng** » 15 Apr 2003 9:26 am

Marco - you hit the nail right on the head.

Joerg Hennig · Post by **Joerg Hennig** » 15 Apr 2003 9:41 am

What just happened here was this: I just had a whole bunch of emails in my box, most all from names or addresses that seem familiar from the Forum and the subject was always the same: REMOVE. Nothing else. Some had attachments and others not. Since I´m very careful about those things, I deleted them all. Will run a virus scan now. Did it happen like that (REMOVE) to others too?[This message was edited by Joe Henry on 15 April 2003 at 02:58 PM.]

Terry Wendt · Post by **Terry Wendt** » 15 Apr 2003 10:08 am

Jim Phelps,

You are WAY OFF! I had Anti-Virus running since I first got online in 1997-early 1998. I don't claim to know everything but I do know I have very good anti-virus and firewall protection.

Ken, Marco,

You're both very warm, however, Drew is incorrect saying that the messages are coming from us. Both "headers and from:" fields on messages CAN BE HIJACKED, and appear to come from an origin other than the true origin of the message. I know of programs (though I believe to be very unethical) that are designed to do just this, for purposes of spam and mass mailing. It IS possible that a virus can do this, but like Marco said, the most of the messages are coming through clean... but NOT ALL OF THEM are clean... which would lead me to believe that this may have been intentional, and done "by a real live person".

It would be total incompetence on my part to do anything like this, and I would gain nothing in the process! (And, at present, this has KILLED the magazine.)

If anyone looks at the "guts" of the message including "SMPT" and "DNS" information they will find that both the "reply to/return address" (listed as ours) and the "from address" (also listed as ours) do not resolve to our server.

They are not coming from our server, nor are they directed to return to it either. I am receiving "FWD:'s" of the message (from friends trying to help) and the headers inside don't jive!

Some things ARE being changed that might indicate a virus, due to the method in which they appear to have been changed. EX: When the "subject" line comes up changed, (such as: "JJ guitar") it would indicate to me that a virus might have gotten a hold of the "body of the message" and "distorted it" and then re-inserted it back into the "subject" line, and finally sending the message back out. However, I have only received a handful of emails (35-40) that have contained distorted "subject" line and "CJDBGTR.EXE" files attached. Obviously, Norton deleted those messages in their entirety and I did not see the guts of these messages.

The hundreds of emails I am receiving and able to look at DO NOT HAVE our SMPT server listed as origin, nor any of our related information whatsoever that I can tell.

I am saddened that the folks (not all, but many) up here are so quick to condemn over something so trivial. Just hit delete for a few days. DO NOT OPEN THE MESSAGES, and for God's sake, DO NOT HIT REPLY!!!!!

David L. Donald · Post by **David L. Donald** » 15 Apr 2003 10:33 am

Terry, this has not killed the magazine.. at least not for me.
it will get straighened out and you will go on.

P Perry · Post by **P Perry** » 15 Apr 2003 10:34 am

Terry
Thank You for the serious approach,and the advise.
Jim,
I wasn't mad or upset at anyone I just did not think it was a time for light heartedness or comedy. I am sorry if I offended you or anyone else, please forgive me.

Jim West · Post by **Jim West** » 15 Apr 2003 10:38 am

I'm with you David, this has not at all killed the magazine for me and my one year subscription is still good. Hang in there Terry, this will be over with and we can move on to more productive things.

Jim West · Post by **Jim West** » 15 Apr 2003 10:41 am

Jim,
I wasn't mad or upset at anyone I just did not think it was a time for light heartedness or comedy. I am sorry if I offended you or anyone else, please forgive me. 

No sweat P Perry! No offense taken at all.

Now let's get back to real world issues like steelin'!!!!

Jim West

Jim Phelps · Post by **Jim Phelps** » 15 Apr 2003 10:53 am

"You are WAY OFF!"

That remains to be seen. Could be. You say, "I had Anti-Virus running since I first got online in 1997-early 1998." That's exactly what my bandleader said. She had 365 files infected with 4 different viruses. She had Norton Antivirus and thought she was safe. She had the older version that doesn't automatically update itself, you have to click "update", and she hadn't in years. Is yours up to date and set to protect email?

Nothing I wrote was intended as a personal attack, Terry. I don't even know you. I said it sounds like a virus (it still does) and then I posted again and said it COULD be another kind of bug in your computer and ANYONE would be irresponsible not to have virus protection, especially if they're in business. I stand by everything I said. [This message was edited by Jim Phelps on 15 April 2003 at 01:37 PM.]

Russ Young · Post by **Russ Young** » 15 Apr 2003 11:01 am

Terry:

This whole e-mail episode has pushed me over the edge ... it made me quit procrastinating and subscribe for a year.

I hope that I didn't just send my VISA card number to everyone on the mailing list, though.

Hang in there; this could have happened to any of us.

Charlie Vaughn · Post by **Charlie Vaughn** » 15 Apr 2003 11:32 am

Yep same problem here. I got a lot of E-mails meant for The magazine. I have Norton anti virus and it did not pick up a virus but it could be a real new one. Sorry you are having problems Terry, Still subscribing to the magazine. Good Luck

Marco Schouten · Post by **Marco Schouten** » 15 Apr 2003 11:52 am

Terry,

don't worry, we have the patience to learn to play steel, so these things can't bother us. Keep on goin'.

------------------
Steelin' Greetings
Marco Schouten
Sho-Bud Pro III Custom; Sho-Bud LLG; John Pearse bar; Emmons bar; Panther amp

Jim Phelps · Post by **Jim Phelps** » 15 Apr 2003 12:44 pm

I just want to add, that this whole mess indeed could be just a glitch in Terry's system and that Terry did nothing whatsoever to cause or contribute to it. What pushes me over the edge, is people yelling, "It's not Terry's fault! I repeat, it's NOT TERRY'S FAULT!!!" when no one even knows what the problem is yet, or how it happened, or whose fault, if anyone's, it may be. It may be someone's fault, it may not be. I'm not saying it's Terry's fault, it may be. I'm also not saying "IT'S NOT TERRY'S FAULT!!" because no one knows. I stand by it's our own responsibility to keep our computers protected from viruses. Could be Terry's done that and this is something else. Besides, even if it is Terry's "fault" in some way, so what? I make mistakes, you all do too. I'm sure whatever the problem is, Terry will fix it and everything will be A-OK soon, so let's relax and not worry about whose fault it is, only that the problem is solved soon.

PS. Just found a new post from Terry where he says his antivirus is up to date and he has a good firewall. On that info, it does seem that this email problem is coming from someone else. I wish him good luck with solving the problem and his magazine. [This message was edited by Jim Phelps on 15 April 2003 at 02:27 PM.]

Terry Wendt · Post by **Terry Wendt** » 15 Apr 2003 1:45 pm

Jim P,

You admit you don't know me. So, I can't imagine why you are so convinced NOBODY KNOWS what is causing this (including me) when you admittedly have no earthly idea who I am or what my background is! It seems an automatic assumption on your part, that nobody up here knows what you know?

I DO KNOW that the message was tampered with after it left our web hosting company server (which is located in Colorado). I also know that the message body was created in NOTEPAD (plain text) and then pasted it into a SSL Form on our web server. I believe there is no chance of having a virus within a text file (that is invisible). Our Hosting provider has even more extensive anti-spam, anti-virus software than I could imagine having on a small company PC or Network as we are running, and they are VERY SOLIDLY standing by the fact that this message WAS TAMPERED WITH AFTER it left their server.

So, I believe I DO KNOW that it is not on my end, THEREFORE HOW CAN I FIX IT??????

Reggie Duncan · Post by **Reggie Duncan** » 15 Apr 2003 1:54 pm

Terry Wendt, you have been sabotaged, in my opinion. Keep the faith!

Marco Schouten · Post by **Marco Schouten** » 15 Apr 2003 2:00 pm

You have to read the log from bottom to up. You see that someone replied to the e-mail and the destination is PedalSteel.us@TheEarlyDays.com. The message arrives at host2.dialyourweb.com, ip-adress 209.239.38.34. I checked with nslookup and this host and ip-adress match. this server also handles the e-mail. The ip range belongs to Alabanza Inc. As you look further you see : for <mschout@xs4all.nl>; Tue, 15 Apr 2003 08:37:55 +0200 (CEST)
Received: (from tkwendt1@localhost)
by host2.dialyourweb.com

the message is sent by tkwendt1@localhost via host2.dialyourweb.com to me. Terry says in another tread that he has ip-adress 65.108.217.217. This adress also belongs to Alabanza Inc., Obviously the company that hosts the pedalsteel.us site
So I think there really is no sabottage, and of coarse it might have picked up a virus from someone, but the real cause is that some of the replies are send back to the e-mail distribution list. Maybe some e-mail servers or programs mix up the from and reply to fields, but you must make sure that the e-mail distribution list cannot me mailed to from outside.

Return-Path: <tkwendt1@host2.dialyourweb.com>
Received: from mxzilla3.xs4all.nl (mxzilla3.xs4all.nl [194.109.6.49])
by maildrop7.xs4all.nl (8.12.6/8.12.6) with ESMTP id h3F6bt2V043341
for <mschout@maildrop.xs4all.nl>; Tue, 15 Apr 2003 08:37:55 +0200 (CEST)
X-XS4ALL-DNSBL-Checked: mxzilla3.xs4all.nl checked 209.239.38.34 against DNS blacklists
X-XS4ALL-Pad: empty
Received: from host2.dialyourweb.com (host2.dialyourweb.com [209.239.38.34])
by mxzilla3.xs4all.nl (8.12.3/8.12.3) with ESMTP id h3F6bslM083229
for <mschout@xs4all.nl>; Tue, 15 Apr 2003 08:37:55 +0200 (CEST)
Received: (from tkwendt1@localhost)
by host2.dialyourweb.com (8.11.6/8.11.6) id h3F21jm07132
for mschout@xs4all.nl; Mon, 14 Apr 2003 22:01:45 -0400
Received: from ms-smtp-02.***** (ms-smtp-02.****[24.93.36.230])
by host2.dialyourweb.com (8.11.6/8.11.6) with ESMTP id h3F1rB302066
for <PedalSteel.us@TheEarlyDays.com>; Mon, 14 Apr 2003 21:53:11 -0400
Received: from ***** (********[24.27.112.194])
by ms-smtp-02.texas.rr.com (8.12.5/8.12.2) with SMTP id h3F1r9kP005040
for <PedalSteel.us@TheEarlyDays.com>; Mon, 14 Apr 2003 20:53:10 -0500 (CDT)
Message-ID: <00de01c302f1$c36843f0$c2701b18@cross1>
From: "*******" <******@*****.***>
To: <PedalSteel.us@theearlydays.com>
Subject: Fw: REMOVE
Date: Mon, 14 Apr 2003 20:53:07 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_00DB_01C302C7.D9EBC2C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-UIDL: 1050388676.maildrop7.43352

------------------
Steelin' Greetings
Marco Schouten
Sho-Bud Pro III Custom; Sho-Bud LLG; John Pearse bar; Emmons bar; Panther amp

Jim Phelps · Post by **Jim Phelps** » 15 Apr 2003 2:17 pm

Terry, at the time I posted "no one knows what happened", I hadn't seen any information by you or anyone else stating what had happened. I thought I made it pretty plain in adding PS's to some of my posts as well as new posts, that I took your words at face value when you LATER posted that you were sure it wasn't on your end.

Calm down and get off my case.

b0b · Post by **b0b** » 15 Apr 2003 5:42 pm

I don't think that this is a virus. I agree with Marco. I think that a spam was sent out that said, in part, "Reply to this email with REMOVE in the subject line to be removed from this list." However, the "Reply-to" address in that original message was the address of the WHOLE LIST.

When the mail server that maintains the list received the "REMOVE" message, it forwarded it to everyone on the list.

I don't know where the list came from, or what server is hosting it. I can guarantee that it didn't come from the Forum server, though. I don't maintain an email list, but if I did I wouldn't put it on a web server anywhere.

------------------
<img align=left src="http://b0b.com/coolb0b2.gif" border="0"> Bobby Lee
-b0b- quasar@b0b.com 
-System Administrator