USERS AREA

This page provides the latest information on the status of GreenNet's servers and network.  Visit this site regularly and you will know the network status of your locally-owned and family-managed ISP.

If you wish to access our Technical Updates archive click here.  If you have any problems please contact technical support at support@greennet.net, or by calling 978-363-8898

Tuesday, August 17th, 10:30am  ***Email SCAM ALERT***

We are seeing incidence of "spoofed" (official-looking but fake and fraudulent) email, purporting to be from eBay asking you to re-enter your username and password, because your personal information "needs to be confirmed". The subject is usually "Security Issues" One way you can tell that the message is spoofed is because it is sent to an email address that eBay does not have.  Below is an example of such spoofed messages:

<begin spoofed message>


Dear valued eBay member:

We recently have determined that different computers have logged onto your eBay account, and multiple password failures were present before the logons. We now need you to re-confirm your account information to us. If this is not completed by August 30, 2004, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner.

To confirm your eBay records click here:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate <=== de-linked to prevent unintentional use 

We appreciate your support and understanding, as we work together to keep eBay a safe place to trade.
Thank you for your patience in this matter.

Trust and Safety Department
eBay Inc.

Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.

Copyright 1995-2004 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. Use of this Web site constitutes acceptance of the eBay User Agreement and Privacy Policy. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc. eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.
 <end spoofed message>

We have reported this activity to ebay, who immediately gave us the following response.

<Official response from  eBay>
 Hello,

 Thank you for writing to eBay regarding the email you received.

 Emails such as this, commonly referred to as "spoof" or "phished"
 messages, are sent in an attempt to collect sensitive personal or
 financial information from the recipients.

 The email you reported was not sent by eBay. We have reported this email
 to the appropriate authorities.

 In the future, be very cautious of any email that asks you to submit
 information such as your credit card number or your email password. eBay
 will never ask you for sensitive personal information such as passwords,
 bank account or credit card numbers, Personal Identification Numbers
 (PINs), or Social Security Numbers in an email. If you ever need to
 provide sensitive information to us, please open a new Web browser, type
 www.ebay.com into your browser address field, and click on the "site
 map" link located at the top the page to access the eBay page you need.

 If you have any doubt about whether an email message is from eBay,
 please forward it immediately to spoof@ebay.com. Do not respond to it or
 click any of the links. Do not remove the original subject line or
 change the email in any way when you forward it to us.

 If you have already entered sensitive financial information or your
 password into a Web site based on a request from a spoofed email, you
 should take immediate action to protect your identity and all of your
 online accounts. We have developed an eBay Help page with valuable
 information regarding the steps you should take to protect yourself.

  http://pages.ebay.com/help/confidence/isgw-account-theft-reporting.html

 To review eBay's new tutorial about Spoof Emails, please see the
 following Web page:

  http://pages.ebay.com/education/spooftutorial/

 Once again, thank you for alerting us to the spoof email you received.
 Your efforts help us ensure that eBay remains a safe and vibrant online
 marketplace.

 Regards,

 Ian
 eBay SafeHarbor
 Investigations Team
 ______________________________
 eBay
 Your Personal Trading Community (tm)

 *******************************************

 Important: eBay will not ask you for sensitive personal information
 (such as your password, credit card and bank account numbers, Social
 Security numbers, etc.) in an email. Learn more account protection tips
 at:

 http://www.pages.ebay.com/help/account_protection.html
 _____________________________________________

 For our latest announcements, please check:

 http://www2.ebay.com/aw/announce.shtml
<end of official eBay response>

Thursday, July 15th, 9:30am

ur mail server was acting up all day yesterday. Performance was erratic and it was most noticeable using Webmail.  We fixed the problem his morning at 9:00am. The culprit was a faulty wire connection. The last thing we thought!.  No mail (sending or receiving) was lost. However, there will be plenty of delayed messages that will now arrive after the pending queues are cleared.  We apologize for the inconvenience

All servers and services are up and running normally.

Thursday, June 10th, 4:30pm

There has been SUBSTANTIAL increase in the amount of viruses and malware (spyware, Trojans, hijackware, worms) during the past few days. Nowadays, no Internet-connectable computer should be without an anti-virus program and a firewall. 

Today we attended a Microsoft seminar where the software giant announced the release of Windows XP Service Pack 2. The latest version of Windows comes with built-in firewall and a security console to protect against hackers and malware attacks.  However Windows XP SP2 is over 340Megs of code. Do not attempt to downloaded it! You are better off getting a copy in a CD-ROM. As Microsoft partners, we have received the early release copy of SP2 and will be happy to install it on your computer. Please give us a call.

All servers are up and running normally

Tuesday, May 25th, 10:30am

We have received complaints from two customers indicating that email addressed to their GreenNet-managed email addresses is either being rejected (i.e. pop3.greennet.net did not accept delivery) or delayed by over 4 days.  We are investigating both cases, but we have not found any errors (or cause) on our end. If you re experiencing the same problem, please forward the error message (with full headers) to support@greennet.net.

All servers are up and running normally

Tuesday, April 27th, 5:30pm

We have migrated our web servers to Windows 2000 and IIS 5.0. Previously we were running Windows 4.0 SP6.0a and ISS 4.0. There have been some migration glitches, but we have been able to work them all out, specially those ones concerning permissions.  If you have any issues accessing our updating your website, please give us a call and we will check it out. The upgrade was mandated because of the new features and also because the older versions are no longer being supported.

We appreciate your understanding.  All other servers are up and running.

Saturday, April 24th, 4:30pm

Due to a hardware failure, our web server went down this morning at around 10:00am. Fortunately our engineers were able to get the backup server up and running couple hours later. Because the backup was also lost, we had to recreate all the websites (no data files were lost) from scratch. If your website is not "quite right" please give us a call and we will straighten it out. We apologize for the inconvenience.

All other server are up and running normally

Saturday, April 3rd, 4:30pm.

Webmail is up and working! All other servers and services are also and running normally

Saturday, April 3rd, 12:00 noon.

WebMail is not working. This morning we upgraded to the newest software release and it somehow lost our subscription key and it now says that the subscription is expired. We are working to resolve this problem. We have contacted the software vendor buy since it is the weekend we have not been able to find any help. We apologize for the inconvenience.

Tuesday, March 23rd, 10:00am.

Road Runner has finally(!) removed their block on email sent by GreenNet. One of our customer's daughters (a Road Runner customer) was instrumental in getting it done. Thank you very much Amy.

All servers are up and running normally.

Friday, March 19th, 10:00am.

Road Runner is STILL blocking email from us. Below is part of an email sent by our President.

<begin quote>
We never received a message from Road Runner that they were blocking mail messages from us.  Consequently, we also do not know why we are being blocked.  I have sent COUNTLESS (for the past three weeks) messages to removal@security.rr.com requesting that the block be removed. I have yet to receive a non-automated response despite of what the automated response says. I have included the complete message (including the so called "error code", although there is no  way to exactly know what Road Runner considers the error code, because there is no such thing on the automated responses that we get. Please assist us by doing something besides referring to removal@security.rr.com, because this approach is obviously broken and doesn't work. If you have an alternative email address (or a phone
number, so that I can deal with a human, as opposed to a mail auto-responder), It  will be GREATLY appreciated.

I understand security and Spam issues. We deal with them ourselves. But Road Runner's approach is so inflexible that it is counterproductive. We are all  very frustrated with Road Runners inflexibility and inability to solve a  problem other that to pass the buck back.  I am seriously considering  blocking all incoming mail from Road Runner. I know it will not help, and it  will be a disservice to our respective customers, but maybe this is the way to get Road Runners management's attention.
<end quote>

A very helpful Road Runner tech support associate, after several tries finally gave up and gave this answer to one of their customers (since they are not allowed to talk to us)

<begin quote>
I spoke with our network operations center and unfortunately they can not assist with this issue because the system is functioning as designed.  If email has been sent to removal@security.rr.com it will be handled in the order it was received.  Unfortunately I can not assist further than this. For the time being I would suggest using a third party email like Yahoo or Hotmail.  
<end quote>

Can you believe that? Their block-removal system is broken and their official answer is "they can not assist with this issue because the system is functioning as designed"  In other words it is designed to arbitrarily place blocks in place. Those blocks cannot be removed even if they are incorrectly placed.  If it wasn't so stupid, it would be funny. So because their blocking system is broken, no one can fix it and their customers are forced to use third party email. Unbelievable!  I guess this is what happens when big bureaucracies forget why they are in business. Unlike Road Runner, if we ever had this problem we would solve it in minutes (not even hours, least of all weeks!)  If Road Runner cannot (or will not) remove the block by Monday March 22, 2004, we will begin blocking their mail.

Monday, March 8th, 11:00am.

For some reason (yet unknown to us), Road Runner (a large cable ISP using the rr.com domain name) has decided to block all email coming form GreenNet's IP space (namely, 208.192.4.0/24). As a result, any Greennet customer using any of our outgoing mail servers sending a message to a rr.com email address will receive a "Delivery Status Notification (Failure)" response message. We have contacted Road Runner, and they have not replied to our multiple request to remove the block.  Since we suspect that Road Runner will listen more attentively to their own users, if you run into this problem, we recommend that you contact your recipient (the Road Runner user) and ask them that they contact their own ISP (i.e. Road Runner) and request them that the block on 208.192.4.0/24 be removed.

We apologize for the inconvenience.

Thursday, March 4th, 10:00am.   ***VIRUS & SCAM ALERT***

Please ignore and delete messages that pretend to be coming from GreenNet "management" (or admin@greennet.net) requesting you to open an attached file (sometimes with a password) in order to "activate" and expiring account or reconfigure it with a "free auto forwarding services". They are SCAMS and virus-laden messages. As these messages have an "official-looking" address and our homepage URL, they appear legitimate, but THEY ARE NOT. We would never send such email messages. We suspect that similar scams are in play, so we recommend our users to be VERY skeptical of messages recommending that you open attachments or reconfigure your mail client.  For a non-technical language explanation of the latest "virus wars", please visit http://news.bbc.co.uk/2/hi/technology/3532009.stm 

Monday, March 1st, 9:00am.

Our News server was down for unscheduled maintenance this past Saturday from11:15am until about 3:00pm.  He had to get rid of some viruses and install the latest Microsoft OS patches. The server has been working flawlessly since them.

All other servers are up and running normally.

Tuesday, February 10th, 10:00am

We experienced problems with our incoming mail server (users could send but not receive e-mail) this morning from 7:30am until 9:30am. The problem was caused by the ongoing virus epidemic that caused huge backlogs on our incoming mail server. Te problem has been fixed and most of the backlog has been worked off.  We apologize for the inconvenience

Friday, February 6th, 10:00am

As reported in the news, the currently active mass-mailing worms and viruses (i.e. MyDoom and its variants) are generating two to three times the normal Internet e-mail traffic. While GreenNet's e-mail servers are protected by two Antivirus programs (Norton and AVAST), the increased e-mail load is creating performance degradation for some of our customers.  Some users have reported "This page cannot displayed" error messages when using Webmail.  This is normal and a "Refresh" (maybe several times) will take care of this problem.

We recognize the importance of e-mail to you and your business, and we have been working diligently to protect you and your business from the effects of this malicious activity.  We appreciate your understanding ad loyalty.

All other servers are running normally.

Wednesday, February 4th, 11:00am

We continue to battle the MyDoom virus epidemic. We have two anti-virus engines (Norton & Avast, www.avast.com) running concurrently but the effects of the virus are sometimes felt.  For example, this morning our incoming mail server was down for about 15 minutes while it recuperated from the virus attack. There was no problem with the outgoing mail server.

Otherwise, all other servers are up and running normally.

Wednesday, January  28th, 1:25pm

This morning we had an outage with our dialup and ISDN lines. It lasted from 9:45am until about 1:00pm. The problem was caused by the  corruption of our authentication files and we could not get the backup copy to quickly translate.  We apologize for the outage. The systems has been working fine since it was re-created at around 1:00pm.

All servers are up and running normally

Tuesday, January  27th, 12:25pm       ***MyDoom VIRUS ALERT***

Yes, the "MyDoom" virus Is here. We have been fighting it for the past few days! Our anti-virus program, which runs natively on our mail server is doing a good job of catching and eliminating all infected files for those customers that subscribe to the service. At $1/mailbox/month is probably the ultimate bargain.  If you do not subscribe to the service please send us an email to suport@greennet.net or call us at 978-363-8898.   This program cleans files before you even download them. We also recommend that you also use a good anti-virus program (Norton or McAfee) for cases when viruses may get into your system outside our mail system. For example web-based email (AOL, Yahoo, and Hotmail) and those fast-circulating floppies.  If you prefer, for $25 we will install Norton Anti-virus 2004 on your computer. The cost of the software (with one year updates) is $50.

A detailed explanation of the virus follows:

MyDoom virus 'biggest in months'
A computer virus spread via e-mail has been described by security experts as the "largest virus outbreak in months".

The malicious worm, called MyDoom or Novarg, has clogged networks and may allow unauthorized access to computers. It arrives as an e-mail attachment in a text file which sends itself out to other e-mail addresses if opened.  Security experts MessageLabs said, at its peak, one in 12 e-mails carried the worm. It has now stopped more than 1.5 million copies of it.  It said this latest rapidly-spreading worm is bigger and faster than SoBig, the virus which crippled inboxes and networks last August, and it shows little sign of slowing. "SoBig, at its peak, infected one in every 17 e-mails, causing many internet relays to become severely clogged," Mark Sunner, chief technology officer at MessageLabs told BBC News Online, ."MyDoom has now surpassed this, infecting an incredible one in every 12 e-mails, and so the impact of this latest virus may be very serious for affected e-mail users."

Fast harvester

The virus, which is also spread through file-sharing networks, is particularly malicious because it may open a "back door" to computers. This is a piece of software which is deposited on a computer's hard drive if the attachment is opened. It listens to commands sent remotely over the net and acts on them.  Many of the e-mails look like they have been sent from organizations like charities or educational institutions, to fool recipients into opening it.


MYDOOM DETAILS
From: random e-mail address
To: address of the recipient
Subject: random words
Message body: several different mail error messages, such as: Mail transaction failed. Partial message is available
Attachment (with a text-file icon): random name ending with ZIP, BAT, CMD, EXE, PIF or SCR extension
When a user clicks on the attachment, the worm will start Notepad, filled with random characters
"MyDoom works by harvesting e-mail addresses from the infected computer, and randomly chooses from these the address identified as the next sender," explained Mr. Sunner.

"The sender is therefore falsified in the MyDoom virus, so it is impossible for the recipient to actually tell where the e-mail has really come from."  Thousands of e-mails triggered by the worm, which only affects computers using Microsoft Windows, were bombarding networks within hours of its discovery on Monday. The worm is similar to 2003's Bugbear and SoBig in the way it spreads, Symantec's Kevin Hogan explained to BBC News Online.  "It is a very simple example. It simply relies on a human to double click on an attachment to run it."

It also seems it will attempt to perform a denial of service attack on SCO from 1 to 12 February, directing infected computers to flood SCO with data, he said. SCO is one of the largest Unix open-source vendors in the world. It has been in the news recently because it has claimed that key parts of the open-source operating system, Linux, are under SCO's copyright. Last year's Blaster worm attempted a similar attack on Microsoft's website, which was stopped.

Delete and update

The e-mail carrying MyDoom often bears the subject "Test" or "Status". The message inside may read: "The message contains Unicode characters and has been sent as a binary attachment".


PROTECT YOURSELF FROM VIRUSES
Install an anti-virus program.
Keep it up to date
Get the latest patches and updates for your operating system
Never automatically open e-mail attachments
Download or purchase software from trusted, reputable sources
Make backups of important files
"MyDoom can pose as a technical-sounding message, claiming that the e-mail body has been put in an attached file," said Graham Cluley from security firm Sophos. "Of course, if you launch that file you are potentially putting your data and computer straight into the hands of hackers." Symantec have advised anyone who has received the worm to avoid opening or double clicking the attachment. Users should also ensure their anti-virus software is updated, so that if the attachment is opened by accident, the software will catch it.

If anti-virus software does not spot an infection once the attachment is launched, users should download the free tools available to deal with it. The security firm added if users start getting unusual pop-up messages from their desktop firewall, the chances are the computer has been infected.

Thursday, January  22nd, 2:25pm

The mails server has been running very nicely since the hardware and software upgrade. If you get an error message indicating that the "pop3.greennet.net mail server cannot be reached", it is because there is a mal-formed messages (probably SPAM) that is clogging up the connection forcing the server to issue a time-out. To solve the problem, use GreenNet WebMail and delete all unwanted messages. Afterwards, go back to your regular mail client (Outlook Express, etc) and download the remaining (good) messages.

All of our servers are up and running normally.

Wednesday, January  7th, 10:30am

Our upgraded mail server (double the processing capacity) has been running flawlessly for the past week.  Wow, what a difference!   We have not received any e-mail-problem technical calls related to the processing power of the mail server since the upgrade.  GreenNet Webmail no longer works sluggishly and it is a joy to use.  We also upgrade the mail server software to the latest release (version 7.01) and that has also made a huge difference.

The new Mail server software has several new features (GroupWare, Calendaring and Secure Instant Messenger) that we will soon offer as a value-added service. Stay tuned for details!  If you felt jealous because young kids were "aiming" or "iming" with their friends anywhere in the world, but wanted a business-class version of the AOL or Microsoft Instant Messenger you can now get the service from GreenNet and have Instant Messaging capabilities buy using your current e-mail address.

We hope you had a wonderful holiday season and wish you the best of happiness and success in the new 2004 year.

All our servers are up and running normally.

 

USERS AREA

This page provides the latest information on the status of GreenNet's servers and network.  Visit this site regularly and you will know the network status of your locally-owned and family-managed ISP.

If you wish to access our Technical Updates archive click here.  If you have any problems please contact technical support at support@greennet.net, or by calling 978-363-8898

Tuesday, August 17th, 10:30am  ***Email SCAM ALERT***

We are seeing incidence of "spoofed" (official-looking but fake and fraudulent) email, purporting to be from eBay asking you to re-enter your username and password, because your personal information "needs to be confirmed". The subject is usually "Security Issues" One way you can tell that the message is spoofed is because it is sent to an email address that eBay does not have.  Below is an example of such spoofed messages:

<begin spoofed message>


Dear valued eBay member:

We recently have determined that different computers have logged onto your eBay account, and multiple password failures were present before the logons. We now need you to re-confirm your account information to us. If this is not completed by August 30, 2004, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner.

To confirm your eBay records click here:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate <=== de-linked to prevent unintentional use 

We appreciate your support and understanding, as we work together to keep eBay a safe place to trade.
Thank you for your patience in this matter.

Trust and Safety Department
eBay Inc.

Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.

Copyright 1995-2004 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. Use of this Web site constitutes acceptance of the eBay User Agreement and Privacy Policy. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc. eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.
 <end spoofed message>

We have reported this activity to ebay, who immediately gave us the following response.

<Official response from  eBay>
 Hello,

 Thank you for writing to eBay regarding the email you received.

 Emails such as this, commonly referred to as "spoof" or "phished"
 messages, are sent in an attempt to collect sensitive personal or
 financial information from the recipients.

 The email you reported was not sent by eBay. We have reported this email
 to the appropriate authorities.

 In the future, be very cautious of any email that asks you to submit
 information such as your credit card number or your email password. eBay
 will never ask you for sensitive personal information such as passwords,
 bank account or credit card numbers, Personal Identification Numbers
 (PINs), or Social Security Numbers in an email. If you ever need to
 provide sensitive information to us, please open a new Web browser, type
 www.ebay.com into your browser address field, and click on the "site
 map" link located at the top the page to access the eBay page you need.

 If you have any doubt about whether an email message is from eBay,
 please forward it immediately to spoof@ebay.com. Do not respond to it or
 click any of the links. Do not remove the original subject line or
 change the email in any way when you forward it to us.

 If you have already entered sensitive financial information or your
 password into a Web site based on a request from a spoofed email, you
 should take immediate action to protect your identity and all of your
 online accounts. We have developed an eBay Help page with valuable
 information regarding the steps you should take to protect yourself.

  http://pages.ebay.com/help/confidence/isgw-account-theft-reporting.html

 To review eBay's new tutorial about Spoof Emails, please see the
 following Web page:

  http://pages.ebay.com/education/spooftutorial/

 Once again, thank you for alerting us to the spoof email you received.
 Your efforts help us ensure that eBay remains a safe and vibrant online
 marketplace.

 Regards,

 Ian
 eBay SafeHarbor
 Investigations Team
 ______________________________
 eBay
 Your Personal Trading Community (tm)

 *******************************************

 Important: eBay will not ask you for sensitive personal information
 (such as your password, credit card and bank account numbers, Social
 Security numbers, etc.) in an email. Learn more account protection tips
 at:

 http://www.pages.ebay.com/help/account_protection.html
 _____________________________________________

 For our latest announcements, please check:

 http://www2.ebay.com/aw/announce.shtml
<end of official eBay response>

Thursday, July 15th, 9:30am

ur mail server was acting up all day yesterday. Performance was erratic and it was most noticeable using Webmail.  We fixed the problem his morning at 9:00am. The culprit was a faulty wire connection. The last thing we thought!.  No mail (sending or receiving) was lost. However, there will be plenty of delayed messages that will now arrive after the pending queues are cleared.  We apologize for the inconvenience

All servers and services are up and running normally.

Thursday, June 10th, 4:30pm

There has been SUBSTANTIAL increase in the amount of viruses and malware (spyware, Trojans, hijackware, worms) during the past few days. Nowadays, no Internet-connectable computer should be without an anti-virus program and a firewall. 

Today we attended a Microsoft seminar where the software giant announced the release of Windows XP Service Pack 2. The latest version of Windows comes with built-in firewall and a security console to protect against hackers and malware attacks.  However Windows XP SP2 is over 340Megs of code. Do not attempt to downloaded it! You are better off getting a copy in a CD-ROM. As Microsoft partners, we have received the early release copy of SP2 and will be happy to install it on your computer. Please give us a call.

All servers are up and running normally

Tuesday, May 25th, 10:30am

We have received complaints from two customers indicating that email addressed to their GreenNet-managed email addresses is either being rejected (i.e. pop3.greennet.net did not accept delivery) or delayed by over 4 days.  We are investigating both cases, but we have not found any errors (or cause) on our end. If you re experiencing the same problem, please forward the error message (with full headers) to support@greennet.net.

All servers are up and running normally

Tuesday, April 27th, 5:30pm

We have migrated our web servers to Windows 2000 and IIS 5.0. Previously we were running Windows 4.0 SP6.0a and ISS 4.0. There have been some migration glitches, but we have been able to work them all out, specially those ones concerning permissions.  If you have any issues accessing our updating your website, please give us a call and we will check it out. The upgrade was mandated because of the new features and also because the older versions are no longer being supported.

We appreciate your understanding.  All other servers are up and running.

Saturday, April 24th, 4:30pm

Due to a hardware failure, our web server went down this morning at around 10:00am. Fortunately our engineers were able to get the backup server up and running couple hours later. Because the backup was also lost, we had to recreate all the websites (no data files were lost) from scratch. If your website is not "quite right" please give us a call and we will straighten it out. We apologize for the inconvenience.

All other server are up and running normally

Saturday, April 3rd, 4:30pm.

Webmail is up and working! All other servers and services are also and running normally

Saturday, April 3rd, 12:00 noon.

WebMail is not working. This morning we upgraded to the newest software release and it somehow lost our subscription key and it now says that the subscription is expired. We are working to resolve this problem. We have contacted the software vendor buy since it is the weekend we have not been able to find any help. We apologize for the inconvenience.

Tuesday, March 23rd, 10:00am.

Road Runner has finally(!) removed their block on email sent by GreenNet. One of our customer's daughters (a Road Runner customer) was instrumental in getting it done. Thank you very much Amy.

All servers are up and running normally.

Friday, March 19th, 10:00am.

Road Runner is STILL blocking email from us. Below is part of an email sent by our President.

<begin quote>
We never received a message from Road Runner that they were blocking mail messages from us.  Consequently, we also do not know why we are being blocked.  I have sent COUNTLESS (for the past three weeks) messages to removal@security.rr.com requesting that the block be removed. I have yet to receive a non-automated response despite of what the automated response says. I have included the complete message (including the so called "error code", although there is no  way to exactly know what Road Runner considers the error code, because there is no such thing on the automated responses that we get. Please assist us by doing something besides referring to removal@security.rr.com, because this approach is obviously broken and doesn't work. If you have an alternative email address (or a phone
number, so that I can deal with a human, as opposed to a mail auto-responder), It  will be GREATLY appreciated.

I understand security and Spam issues. We deal with them ourselves. But Road Runner's approach is so inflexible that it is counterproductive. We are all  very frustrated with Road Runners inflexibility and inability to solve a  problem other that to pass the buck back.  I am seriously considering  blocking all incoming mail from Road Runner. I know it will not help, and it  will be a disservice to our respective customers, but maybe this is the way to get Road Runners management's attention.
<end quote>

A very helpful Road Runner tech support associate, after several tries finally gave up and gave this answer to one of their customers (since they are not allowed to talk to us)

<begin quote>
I spoke with our network operations center and unfortunately they can not assist with this issue because the system is functioning as designed.  If email has been sent to removal@security.rr.com it will be handled in the order it was received.  Unfortunately I can not assist further than this. For the time being I would suggest using a third party email like Yahoo or Hotmail.  
<end quote>

Can you believe that? Their block-removal system is broken and their official answer is "they can not assist with this issue because the system is functioning as designed"  In other words it is designed to arbitrarily place blocks in place. Those blocks cannot be removed even if they are incorrectly placed.  If it wasn't so stupid, it would be funny. So because their blocking system is broken, no one can fix it and their customers are forced to use third party email. Unbelievable!  I guess this is what happens when big bureaucracies forget why they are in business. Unlike Road Runner, if we ever had this problem we would solve it in minutes (not even hours, least of all weeks!)  If Road Runner cannot (or will not) remove the block by Monday March 22, 2004, we will begin blocking their mail.

Monday, March 8th, 11:00am.

For some reason (yet unknown to us), Road Runner (a large cable ISP using the rr.com domain name) has decided to block all email coming form GreenNet's IP space (namely, 208.192.4.0/24). As a result, any Greennet customer using any of our outgoing mail servers sending a message to a rr.com email address will receive a "Delivery Status Notification (Failure)" response message. We have contacted Road Runner, and they have not replied to our multiple request to remove the block.  Since we suspect that Road Runner will listen more attentively to their own users, if you run into this problem, we recommend that you contact your recipient (the Road Runner user) and ask them that they contact their own ISP (i.e. Road Runner) and request them that the block on 208.192.4.0/24 be removed.

We apologize for the inconvenience.

Thursday, March 4th, 10:00am.   ***VIRUS & SCAM ALERT***

Please ignore and delete messages that pretend to be coming from GreenNet "management" (or admin@greennet.net) requesting you to open an attached file (sometimes with a password) in order to "activate" and expiring account or reconfigure it with a "free auto forwarding services". They are SCAMS and virus-laden messages. As these messages have an "official-looking" address and our homepage URL, they appear legitimate, but THEY ARE NOT. We would never send such email messages. We suspect that similar scams are in play, so we recommend our users to be VERY skeptical of messages recommending that you open attachments or reconfigure your mail client.  For a non-technical language explanation of the latest "virus wars", please visit http://news.bbc.co.uk/2/hi/technology/3532009.stm 

Monday, March 1st, 9:00am.

Our News server was down for unscheduled maintenance this past Saturday from11:15am until about 3:00pm.  He had to get rid of some viruses and install the latest Microsoft OS patches. The server has been working flawlessly since them.

All other servers are up and running normally.

Tuesday, February 10th, 10:00am

We experienced problems with our incoming mail server (users could send but not receive e-mail) this morning from 7:30am until 9:30am. The problem was caused by the ongoing virus epidemic that caused huge backlogs on our incoming mail server. Te problem has been fixed and most of the backlog has been worked off.  We apologize for the inconvenience

Friday, February 6th, 10:00am

As reported in the news, the currently active mass-mailing worms and viruses (i.e. MyDoom and its variants) are generating two to three times the normal Internet e-mail traffic. While GreenNet's e-mail servers are protected by two Antivirus programs (Norton and AVAST), the increased e-mail load is creating performance degradation for some of our customers.  Some users have reported "This page cannot displayed" error messages when using Webmail.  This is normal and a "Refresh" (maybe several times) will take care of this problem.

We recognize the importance of e-mail to you and your business, and we have been working diligently to protect you and your business from the effects of this malicious activity.  We appreciate your understanding ad loyalty.

All other servers are running normally.

Wednesday, February 4th, 11:00am

We continue to battle the MyDoom virus epidemic. We have two anti-virus engines (Norton & Avast, www.avast.com) running concurrently but the effects of the virus are sometimes felt.  For example, this morning our incoming mail server was down for about 15 minutes while it recuperated from the virus attack. There was no problem with the outgoing mail server.

Otherwise, all other servers are up and running normally.

Wednesday, January  28th, 1:25pm

This morning we had an outage with our dialup and ISDN lines. It lasted from 9:45am until about 1:00pm. The problem was caused by the  corruption of our authentication files and we could not get the backup copy to quickly translate.  We apologize for the outage. The systems has been working fine since it was re-created at around 1:00pm.

All servers are up and running normally

Tuesday, January  27th, 12:25pm       ***MyDoom VIRUS ALERT***

Yes, the "MyDoom" virus Is here. We have been fighting it for the past few days! Our anti-virus program, which runs natively on our mail server is doing a good job of catching and eliminating all infected files for those customers that subscribe to the service. At $1/mailbox/month is probably the ultimate bargain.  If you do not subscribe to the service please send us an email to suport@greennet.net or call us at 978-363-8898.   This program cleans files before you even download them. We also recommend that you also use a good anti-virus program (Norton or McAfee) for cases when viruses may get into your system outside our mail system. For example web-based email (AOL, Yahoo, and Hotmail) and those fast-circulating floppies.  If you prefer, for $25 we will install Norton Anti-virus 2004 on your computer. The cost of the software (with one year updates) is $50.

A detailed explanation of the virus follows:

MyDoom virus 'biggest in months'
A computer virus spread via e-mail has been described by security experts as the "largest virus outbreak in months".

The malicious worm, called MyDoom or Novarg, has clogged networks and may allow unauthorized access to computers. It arrives as an e-mail attachment in a text file which sends itself out to other e-mail addresses if opened.  Security experts MessageLabs said, at its peak, one in 12 e-mails carried the worm. It has now stopped more than 1.5 million copies of it.  It said this latest rapidly-spreading worm is bigger and faster than SoBig, the virus which crippled inboxes and networks last August, and it shows little sign of slowing. "SoBig, at its peak, infected one in every 17 e-mails, causing many internet relays to become severely clogged," Mark Sunner, chief technology officer at MessageLabs told BBC News Online, ."MyDoom has now surpassed this, infecting an incredible one in every 12 e-mails, and so the impact of this latest virus may be very serious for affected e-mail users."

Fast harvester

The virus, which is also spread through file-sharing networks, is particularly malicious because it may open a "back door" to computers. This is a piece of software which is deposited on a computer's hard drive if the attachment is opened. It listens to commands sent remotely over the net and acts on them.  Many of the e-mails look like they have been sent from organizations like charities or educational institutions, to fool recipients into opening it.


MYDOOM DETAILS
From: random e-mail address
To: address of the recipient
Subject: random words
Message body: several different mail error messages, such as: Mail transaction failed. Partial message is available
Attachment (with a text-file icon): random name ending with ZIP, BAT, CMD, EXE, PIF or SCR extension
When a user clicks on the attachment, the worm will start Notepad, filled with random characters
"MyDoom works by harvesting e-mail addresses from the infected computer, and randomly chooses from these the address identified as the next sender," explained Mr. Sunner.

"The sender is therefore falsified in the MyDoom virus, so it is impossible for the recipient to actually tell where the e-mail has really come from."  Thousands of e-mails triggered by the worm, which only affects computers using Microsoft Windows, were bombarding networks within hours of its discovery on Monday. The worm is similar to 2003's Bugbear and SoBig in the way it spreads, Symantec's Kevin Hogan explained to BBC News Online.  "It is a very simple example. It simply relies on a human to double click on an attachment to run it."

It also seems it will attempt to perform a denial of service attack on SCO from 1 to 12 February, directing infected computers to flood SCO with data, he said. SCO is one of the largest Unix open-source vendors in the world. It has been in the news recently because it has claimed that key parts of the open-source operating system, Linux, are under SCO's copyright. Last year's Blaster worm attempted a similar attack on Microsoft's website, which was stopped.

Delete and update

The e-mail carrying MyDoom often bears the subject "Test" or "Status". The message inside may read: "The message contains Unicode characters and has been sent as a binary attachment".


PROTECT YOURSELF FROM VIRUSES
Install an anti-virus program.
Keep it up to date
Get the latest patches and updates for your operating system
Never automatically open e-mail attachments
Download or purchase software from trusted, reputable sources
Make backups of important files
"MyDoom can pose as a technical-sounding message, claiming that the e-mail body has been put in an attached file," said Graham Cluley from security firm Sophos. "Of course, if you launch that file you are potentially putting your data and computer straight into the hands of hackers." Symantec have advised anyone who has received the worm to avoid opening or double clicking the attachment. Users should also ensure their anti-virus software is updated, so that if the attachment is opened by accident, the software will catch it.

If anti-virus software does not spot an infection once the attachment is launched, users should download the free tools available to deal with it. The security firm added if users start getting unusual pop-up messages from their desktop firewall, the chances are the computer has been infected.

Thursday, January  22nd, 2:25pm

The mails server has been running very nicely since the hardware and software upgrade. If you get an error message indicating that the "pop3.greennet.net mail server cannot be reached", it is because there is a mal-formed messages (probably SPAM) that is clogging up the connection forcing the server to issue a time-out. To solve the problem, use GreenNet WebMail and delete all unwanted messages. Afterwards, go back to your regular mail client (Outlook Express, etc) and download the remaining (good) messages.

All of our servers are up and running normally.

Wednesday, January  7th, 10:30am

Our upgraded mail server (double the processing capacity) has been running flawlessly for the past week.  Wow, what a difference!   We have not received any e-mail-problem technical calls related to the processing power of the mail server since the upgrade.  GreenNet Webmail no longer works sluggishly and it is a joy to use.  We also upgrade the mail server software to the latest release (version 7.01) and that has also made a huge difference.

The new Mail server software has several new features (GroupWare, Calendaring and Secure Instant Messenger) that we will soon offer as a value-added service. Stay tuned for details!  If you felt jealous because young kids were "aiming" or "iming" with their friends anywhere in the world, but wanted a business-class version of the AOL or Microsoft Instant Messenger you can now get the service from GreenNet and have Instant Messaging capabilities buy using your current e-mail address.

We hope you had a wonderful holiday season and wish you the best of happiness and success in the new 2004 year.

All our servers are up and running normally.

 

USERS AREA

This page provides the latest information on the status of GreenNet's servers and network.  Visit this site regularly and you will know the network status of your locally-owned and family-managed ISP.

If you wish to access our Technical Updates archive click here.  If you have any problems please contact technical support at support@greennet.net, or by calling 978-363-8898

Tuesday, August 17th, 10:30am  ***Email SCAM ALERT***

We are seeing incidence of "spoofed" (official-looking but fake and fraudulent) email, purporting to be from eBay asking you to re-enter your username and password, because your personal information "needs to be confirmed". The subject is usually "Security Issues" One way you can tell that the message is spoofed is because it is sent to an email address that eBay does not have.  Below is an example of such spoofed messages:

<begin spoofed message>


Dear valued eBay member:

We recently have determined that different computers have logged onto your eBay account, and multiple password failures were present before the logons. We now need you to re-confirm your account information to us. If this is not completed by August 30, 2004, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner.

To confirm your eBay records click here:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate <=== de-linked to prevent unintentional use 

We appreciate your support and understanding, as we work together to keep eBay a safe place to trade.
Thank you for your patience in this matter.

Trust and Safety Department
eBay Inc.

Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.

Copyright 1995-2004 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. Use of this Web site constitutes acceptance of the eBay User Agreement and Privacy Policy. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc. eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.
 <end spoofed message>

We have reported this activity to ebay, who immediately gave us the following response.

<Official response from  eBay>
 Hello,

 Thank you for writing to eBay regarding the email you received.

 Emails such as this, commonly referred to as "spoof" or "phished"
 messages, are sent in an attempt to collect sensitive personal or
 financial information from the recipients.

 The email you reported was not sent by eBay. We have reported this email
 to the appropriate authorities.

 In the future, be very cautious of any email that asks you to submit
 information such as your credit card number or your email password. eBay
 will never ask you for sensitive personal information such as passwords,
 bank account or credit card numbers, Personal Identification Numbers
 (PINs), or Social Security Numbers in an email. If you ever need to
 provide sensitive information to us, please open a new Web browser, type
 www.ebay.com into your browser address field, and click on the "site
 map" link located at the top the page to access the eBay page you need.

 If you have any doubt about whether an email message is from eBay,
 please forward it immediately to spoof@ebay.com. Do not respond to it or
 click any of the links. Do not remove the original subject line or
 change the email in any way when you forward it to us.

 If you have already entered sensitive financial information or your
 password into a Web site based on a request from a spoofed email, you
 should take immediate action to protect your identity and all of your
 online accounts. We have developed an eBay Help page with valuable
 information regarding the steps you should take to protect yourself.

  http://pages.ebay.com/help/confidence/isgw-account-theft-reporting.html

 To review eBay's new tutorial about Spoof Emails, please see the
 following Web page:

  http://pages.ebay.com/education/spooftutorial/

 Once again, thank you for alerting us to the spoof email you received.
 Your efforts help us ensure that eBay remains a safe and vibrant online
 marketplace.

 Regards,

 Ian
 eBay SafeHarbor
 Investigations Team
 ______________________________
 eBay
 Your Personal Trading Community (tm)

 *******************************************

 Important: eBay will not ask you for sensitive personal information
 (such as your password, credit card and bank account numbers, Social
 Security numbers, etc.) in an email. Learn more account protection tips
 at:

 http://www.pages.ebay.com/help/account_protection.html
 _____________________________________________

 For our latest announcements, please check:

 http://www2.ebay.com/aw/announce.shtml
<end of official eBay response>

Thursday, July 15th, 9:30am

ur mail server was acting up all day yesterday. Performance was erratic and it was most noticeable using Webmail.  We fixed the problem his morning at 9:00am. The culprit was a faulty wire connection. The last thing we thought!.  No mail (sending or receiving) was lost. However, there will be plenty of delayed messages that will now arrive after the pending queues are cleared.  We apologize for the inconvenience

All servers and services are up and running normally.

Thursday, June 10th, 4:30pm

There has been SUBSTANTIAL increase in the amount of viruses and malware (spyware, Trojans, hijackware, worms) during the past few days. Nowadays, no Internet-connectable computer should be without an anti-virus program and a firewall. 

Today we attended a Microsoft seminar where the software giant announced the release of Windows XP Service Pack 2. The latest version of Windows comes with built-in firewall and a security console to protect against hackers and malware attacks.  However Windows XP SP2 is over 340Megs of code. Do not attempt to downloaded it! You are better off getting a copy in a CD-ROM. As Microsoft partners, we have received the early release copy of SP2 and will be happy to install it on your computer. Please give us a call.

All servers are up and running normally

Tuesday, May 25th, 10:30am

We have received complaints from two customers indicating that email addressed to their GreenNet-managed email addresses is either being rejected (i.e. pop3.greennet.net did not accept delivery) or delayed by over 4 days.  We are investigating both cases, but we have not found any errors (or cause) on our end. If you re experiencing the same problem, please forward the error message (with full headers) to support@greennet.net.

All servers are up and running normally

Tuesday, April 27th, 5:30pm

We have migrated our web servers to Windows 2000 and IIS 5.0. Previously we were running Windows 4.0 SP6.0a and ISS 4.0. There have been some migration glitches, but we have been able to work them all out, specially those ones concerning permissions.  If you have any issues accessing our updating your website, please give us a call and we will check it out. The upgrade was mandated because of the new features and also because the older versions are no longer being supported.

We appreciate your understanding.  All other servers are up and running.

Saturday, April 24th, 4:30pm

Due to a hardware failure, our web server went down this morning at around 10:00am. Fortunately our engineers were able to get the backup server up and running couple hours later. Because the backup was also lost, we had to recreate all the websites (no data files were lost) from scratch. If your website is not "quite right" please give us a call and we will straighten it out. We apologize for the inconvenience.

All other server are up and running normally

Saturday, April 3rd, 4:30pm.

Webmail is up and working! All other servers and services are also and running normally

Saturday, April 3rd, 12:00 noon.

WebMail is not working. This morning we upgraded to the newest software release and it somehow lost our subscription key and it now says that the subscription is expired. We are working to resolve this problem. We have contacted the software vendor buy since it is the weekend we have not been able to find any help. We apologize for the inconvenience.

Tuesday, March 23rd, 10:00am.

Road Runner has finally(!) removed their block on email sent by GreenNet. One of our customer's daughters (a Road Runner customer) was instrumental in getting it done. Thank you very much Amy.

All servers are up and running normally.

Friday, March 19th, 10:00am.

Road Runner is STILL blocking email from us. Below is part of an email sent by our President.

<begin quote>
We never received a message from Road Runner that they were blocking mail messages from us.  Consequently, we also do not know why we are being blocked.  I have sent COUNTLESS (for the past three weeks) messages to removal@security.rr.com requesting that the block be removed. I have yet to receive a non-automated response despite of what the automated response says. I have included the complete message (including the so called "error code", although there is no  way to exactly know what Road Runner considers the error code, because there is no such thing on the automated responses that we get. Please assist us by doing something besides referring to removal@security.rr.com, because this approach is obviously broken and doesn't work. If you have an alternative email address (or a phone
number, so that I can deal with a human, as opposed to a mail auto-responder), It  will be GREATLY appreciated.

I understand security and Spam issues. We deal with them ourselves. But Road Runner's approach is so inflexible that it is counterproductive. We are all  very frustrated with Road Runners inflexibility and inability to solve a  problem other that to pass the buck back.  I am seriously considering  blocking all incoming mail from Road Runner. I know it will not help, and it  will be a disservice to our respective customers, but maybe this is the way to get Road Runners management's attention.
<end quote>

A very helpful Road Runner tech support associate, after several tries finally gave up and gave this answer to one of their customers (since they are not allowed to talk to us)

<begin quote>
I spoke with our network operations center and unfortunately they can not assist with this issue because the system is functioning as designed.  If email has been sent to removal@security.rr.com it will be handled in the order it was received.  Unfortunately I can not assist further than this. For the time being I would suggest using a third party email like Yahoo or Hotmail.  
<end quote>

Can you believe that? Their block-removal system is broken and their official answer is "they can not assist with this issue because the system is functioning as designed"  In other words it is designed to arbitrarily place blocks in place. Those blocks cannot be removed even if they are incorrectly placed.  If it wasn't so stupid, it would be funny. So because their blocking system is broken, no one can fix it and their customers are forced to use third party email. Unbelievable!  I guess this is what happens when big bureaucracies forget why they are in business. Unlike Road Runner, if we ever had this problem we would solve it in minutes (not even hours, least of all weeks!)  If Road Runner cannot (or will not) remove the block by Monday March 22, 2004, we will begin blocking their mail.

Monday, March 8th, 11:00am.

For some reason (yet unknown to us), Road Runner (a large cable ISP using the rr.com domain name) has decided to block all email coming form GreenNet's IP space (namely, 208.192.4.0/24). As a result, any Greennet customer using any of our outgoing mail servers sending a message to a rr.com email address will receive a "Delivery Status Notification (Failure)" response message. We have contacted Road Runner, and they have not replied to our multiple request to remove the block.  Since we suspect that Road Runner will listen more attentively to their own users, if you run into this problem, we recommend that you contact your recipient (the Road Runner user) and ask them that they contact their own ISP (i.e. Road Runner) and request them that the block on 208.192.4.0/24 be removed.

We apologize for the inconvenience.

Thursday, March 4th, 10:00am.   ***VIRUS & SCAM ALERT***

Please ignore and delete messages that pretend to be coming from GreenNet "management" (or admin@greennet.net) requesting you to open an attached file (sometimes with a password) in order to "activate" and expiring account or reconfigure it with a "free auto forwarding services". They are SCAMS and virus-laden messages. As these messages have an "official-looking" address and our homepage URL, they appear legitimate, but THEY ARE NOT. We would never send such email messages. We suspect that similar scams are in play, so we recommend our users to be VERY skeptical of messages recommending that you open attachments or reconfigure your mail client.  For a non-technical language explanation of the latest "virus wars", please visit http://news.bbc.co.uk/2/hi/technology/3532009.stm 

Monday, March 1st, 9:00am.

Our News server was down for unscheduled maintenance this past Saturday from11:15am until about 3:00pm.  He had to get rid of some viruses and install the latest Microsoft OS patches. The server has been working flawlessly since them.

All other servers are up and running normally.

Tuesday, February 10th, 10:00am

We experienced problems with our incoming mail server (users could send but not receive e-mail) this morning from 7:30am until 9:30am. The problem was caused by the ongoing virus epidemic that caused huge backlogs on our incoming mail server. Te problem has been fixed and most of the backlog has been worked off.  We apologize for the inconvenience

Friday, February 6th, 10:00am

As reported in the news, the currently active mass-mailing worms and viruses (i.e. MyDoom and its variants) are generating two to three times the normal Internet e-mail traffic. While GreenNet's e-mail servers are protected by two Antivirus programs (Norton and AVAST), the increased e-mail load is creating performance degradation for some of our customers.  Some users have reported "This page cannot displayed" error messages when using Webmail.  This is normal and a "Refresh" (maybe several times) will take care of this problem.

We recognize the importance of e-mail to you and your business, and we have been working diligently to protect you and your business from the effects of this malicious activity.  We appreciate your understanding ad loyalty.

All other servers are running normally.

Wednesday, February 4th, 11:00am

We continue to battle the MyDoom virus epidemic. We have two anti-virus engines (Norton & Avast, www.avast.com) running concurrently but the effects of the virus are sometimes felt.  For example, this morning our incoming mail server was down for about 15 minutes while it recuperated from the virus attack. There was no problem with the outgoing mail server.

Otherwise, all other servers are up and running normally.

Wednesday, January  28th, 1:25pm

This morning we had an outage with our dialup and ISDN lines. It lasted from 9:45am until about 1:00pm. The problem was caused by the  corruption of our authentication files and we could not get the backup copy to quickly translate.  We apologize for the outage. The systems has been working fine since it was re-created at around 1:00pm.

All servers are up and running normally

Tuesday, January  27th, 12:25pm       ***MyDoom VIRUS ALERT***

Yes, the "MyDoom" virus Is here. We have been fighting it for the past few days! Our anti-virus program, which runs natively on our mail server is doing a good job of catching and eliminating all infected files for those customers that subscribe to the service. At $1/mailbox/month is probably the ultimate bargain.  If you do not subscribe to the service please send us an email to suport@greennet.net or call us at 978-363-8898.   This program cleans files before you even download them. We also recommend that you also use a good anti-virus program (Norton or McAfee) for cases when viruses may get into your system outside our mail system. For example web-based email (AOL, Yahoo, and Hotmail) and those fast-circulating floppies.  If you prefer, for $25 we will install Norton Anti-virus 2004 on your computer. The cost of the software (with one year updates) is $50.

A detailed explanation of the virus follows:

MyDoom virus 'biggest in months'
A computer virus spread via e-mail has been described by security experts as the "largest virus outbreak in months".

The malicious worm, called MyDoom or Novarg, has clogged networks and may allow unauthorized access to computers. It arrives as an e-mail attachment in a text file which sends itself out to other e-mail addresses if opened.  Security experts MessageLabs said, at its peak, one in 12 e-mails carried the worm. It has now stopped more than 1.5 million copies of it.  It said this latest rapidly-spreading worm is bigger and faster than SoBig, the virus which crippled inboxes and networks last August, and it shows little sign of slowing. "SoBig, at its peak, infected one in every 17 e-mails, causing many internet relays to become severely clogged," Mark Sunner, chief technology officer at MessageLabs told BBC News Online, ."MyDoom has now surpassed this, infecting an incredible one in every 12 e-mails, and so the impact of this latest virus may be very serious for affected e-mail users."

Fast harvester

The virus, which is also spread through file-sharing networks, is particularly malicious because it may open a "back door" to computers. This is a piece of software which is deposited on a computer's hard drive if the attachment is opened. It listens to commands sent remotely over the net and acts on them.  Many of the e-mails look like they have been sent from organizations like charities or educational institutions, to fool recipients into opening it.


MYDOOM DETAILS
From: random e-mail address
To: address of the recipient
Subject: random words
Message body: several different mail error messages, such as: Mail transaction failed. Partial message is available
Attachment (with a text-file icon): random name ending with ZIP, BAT, CMD, EXE, PIF or SCR extension
When a user clicks on the attachment, the worm will start Notepad, filled with random characters
"MyDoom works by harvesting e-mail addresses from the infected computer, and randomly chooses from these the address identified as the next sender," explained Mr. Sunner.

"The sender is therefore falsified in the MyDoom virus, so it is impossible for the recipient to actually tell where the e-mail has really come from."  Thousands of e-mails triggered by the worm, which only affects computers using Microsoft Windows, were bombarding networks within hours of its discovery on Monday. The worm is similar to 2003's Bugbear and SoBig in the way it spreads, Symantec's Kevin Hogan explained to BBC News Online.  "It is a very simple example. It simply relies on a human to double click on an attachment to run it."

It also seems it will attempt to perform a denial of service attack on SCO from 1 to 12 February, directing infected computers to flood SCO with data, he said. SCO is one of the largest Unix open-source vendors in the world. It has been in the news recently because it has claimed that key parts of the open-source operating system, Linux, are under SCO's copyright. Last year's Blaster worm attempted a similar attack on Microsoft's website, which was stopped.

Delete and update

The e-mail carrying MyDoom often bears the subject "Test" or "Status". The message inside may read: "The message contains Unicode characters and has been sent as a binary attachment".


PROTECT YOURSELF FROM VIRUSES
Install an anti-virus program.
Keep it up to date
Get the latest patches and updates for your operating system
Never automatically open e-mail attachments
Download or purchase software from trusted, reputable sources
Make backups of important files
"MyDoom can pose as a technical-sounding message, claiming that the e-mail body has been put in an attached file," said Graham Cluley from security firm Sophos. "Of course, if you launch that file you are potentially putting your data and computer straight into the hands of hackers." Symantec have advised anyone who has received the worm to avoid opening or double clicking the attachment. Users should also ensure their anti-virus software is updated, so that if the attachment is opened by accident, the software will catch it.

If anti-virus software does not spot an infection once the attachment is launched, users should download the free tools available to deal with it. The security firm added if users start getting unusual pop-up messages from their desktop firewall, the chances are the computer has been infected.

Thursday, January  22nd, 2:25pm

The mails server has been running very nicely since the hardware and software upgrade. If you get an error message indicating that the "pop3.greennet.net mail server cannot be reached", it is because there is a mal-formed messages (probably SPAM) that is clogging up the connection forcing the server to issue a time-out. To solve the problem, use GreenNet WebMail and delete all unwanted messages. Afterwards, go back to your regular mail client (Outlook Express, etc) and download the remaining (good) messages.

All of our servers are up and running normally.

Wednesday, January  7th, 10:30am

Our upgraded mail server (double the processing capacity) has been running flawlessly for the past week.  Wow, what a difference!   We have not received any e-mail-problem technical calls related to the processing power of the mail server since the upgrade.  GreenNet Webmail no longer works sluggishly and it is a joy to use.  We also upgrade the mail server software to the latest release (version 7.01) and that has also made a huge difference.

The new Mail server software has several new features (GroupWare, Calendaring and Secure Instant Messenger) that we will soon offer as a value-added service. Stay tuned for details!  If you felt jealous because young kids were "aiming" or "iming" with their friends anywhere in the world, but wanted a business-class version of the AOL or Microsoft Instant Messenger you can now get the service from GreenNet and have Instant Messaging capabilities buy using your current e-mail address.

We hope you had a wonderful holiday season and wish you the best of happiness and success in the new 2004 year.

All our servers are up and running normally.