Epocdigest V1 # 328

-----------------------------------------------------------------------------------

Tips for Posting to the Digest and how to unsubscribe

at the end of the Digest

-----------------------------------------------------------------------------------

Epoc Digest Sun, 31 Aug 2003 Volume 01 : Number 328

************************************************************************

Sent to: 807 subscribers

In today's Epoc Digest 17 messages:

==============================

- Reply to Tony Napier re Virus Attack

- Re: virus attack

- RE: EPOC DIGEST V1 # 327 (39)

- Bounced virus mails...

- virus attack

- Re: TubeRoute

- Virus attack

- Re: virus attack

- Re.: Leaving the Netbook open (4 Itamar)

- Re: Addressing directly various docs (4 Stephane)

- Did you know?

- Re: Is Palmtop Money the worst accounting program ever? (4 Chris)

- Re: Zaurus C700 series (4 Mike W.)

- Re: Cycle through apps (4 Ulrich)

- Re: Fn and Menu keys on the nB? (4 Guillaume)

- Longer lasting cells

- Re: Revo Battery Solution

*++++++++++&

Date: 29 Aug 2003 20:36:25 +0100

From: Hoffman, Susan

Subject: Reply to Tony Napier re Virus Attack

The explanation for your "failed message" message is that the "so big" virus saw your e-mail address in an infected computer's address book and passed on the virus using your address as the sender (although it was obviously not from your computer). That is the transmission methodology of this virus.

It happened to all of us. We just had to wait it out until all the infected computers out there (which were sending the messages) were purged (which took a few days). Meanwhile, our office server took only a day and a half to figure out how to block the repeated incoming salvos (at one point, it was about one per minute). Really annoying.

Susan Katz Hoffman

Pepper Hamilton LLP--------------

3000 Two Logan Square

18th & Arch Streets

Philadelphia, PA 19103

Tel: 215-981-4990

Fax: 215-827-5909

e-mail: hoffmans

web address: www.pepperlaw.com

*++++++++++&

Date: 29 Aug 2003 22:55:10 +0100

From: Martin Guthrie

Subject: Re: virus attack

Reply to: Anthony Napier

> I have happily e mailed throughout this onslaught on Microsoft > safe in the knowledge that EPOC and Psions would be immune. I did > notice four suspicious messages clearly virus ridden and deleted > them. Much to my suprise I have received two recent "failed

> delivery" messages which appear to be infected messages I have

> tried to send on. This puzzles me since I have not touched a

> windows e mail system throughout the last week or so and my PC

> machine also appears completely healthy. I cannot believe these

> rogue e mails are infiltrating a Psion e mail address book? Can

> anyone cast any light on this?

> Tony Napier

Hi Tony,

Chances are that someone/thing has spoofed your email address from somewhere and is spam emailing under your name. The mails that bounce of course come back to where they appear to have originated from - i.e. your email address. Disturbing initially but probably not anything to greatly worry about - except of course that you'll probably receive yet more spam/viral email... :¬(

Best regards,

Martin Guthrie

—————————

www.pscience5.net

www.freepoc.org

*++++++++++&

Date: 29 Aug 2003 23:20:31 +0100

From: Gregory N. Latiak

Subject: RE: EPOC DIGEST V1 # 327 (39)

Date: 28 Aug 2003 07:43:51 +0100

From: Anthony Napier

Subject: Re: virus attack

I have happily e mailed throughout this onslaught on Microsoft safe in the knowledge that EPOC and Psions would be immune. I did notice four suspicious messages clearly virus ridden and deleted them. Much to my suprise I have received two recent "failed delivery" messages which appear to be infected messages I have tried to send on. This puzzles me since I have not touched a windows e mail system throughout the last week or so and my PC machine also appears completely healthy. I cannot believe these rogue e mails are infiltrating a Psion e mail address book? Can anyone cast any light on this? Tony Napier

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++= ===

Anthony,

I see these things all the time. They are a feature of one of the ways that SPAMMERs pervert the mail system -- they package multiple emails together, then rely on the victims mail system to forward part of the payload. Happily, my ISP does not do POP3 outbound, but these things get picked up on the inbound side, attempt to send and fail. I get the 'fail' message. Once we worked out where they were coming from, they are just deleted as they come. Far as I can tell, no real way to block them except a divided mail system -- POP3 in and SMTP or the like out through a different mail server. I dont think it is your PC, unless your mail server IS your PC -- most likely the messages are getting stopped by your ISP. That is what these are -- failures!

greg latiak

toronto

*++++++++++&

Date: 30 Aug 2003 00:35:58 +0100

From: Trygve Henriksen

Subject: Bounced virus mails...

Greetings!

Anthony Napier wrote:

> I have happily e mailed throughout this onslaught on Microsoft safe

> in the knowledge that EPOC and Psions would be immune. I did notice

> four suspicious messages clearly virus ridden and deleted them. Much

> to my suprise I have received two recent "failed delivery" messages

> which appear to be infected messages I have tried to send on.

It's the Sobig.F virus.

When it infects a machine it spreads by mailing itself to everyone in the users address book. It also fakes the sender address by picking one name in the same list and uses that as sender/reply-to address so that tracing and detection will be more difficult.

Quite a common trick amongst the more advanced email viruses, and also spammers...

What pisses me off about this, though, is that I have yet to receive a single copy of the virus at the office, but I HAVE received at least 50 messages from various firms with anti-virus software on their mail gateways, telling me that a message I sent was virus infected...

In the few cases where the mail server returned the complete message I've been able to retrace the mail to the REAL infected machine or the ISP it's connected to. (Two was from medium sized companies)

No, tracking them isn't that difficult.

I really wish people would follow twosimple rules about email:

1. Turn off 'preview' in M$ Don'tLook

(or better yet, use another email program :-)

2. Don't open unexpected mails from people they don't know, or even from people they know, particularly if they contain attachments.

:-)

Trygve

*++++++++++&

Date: 30 Aug 2003 07:17:00 +0100

From: ian chapple

Subject: virus attack

Anthony,

>>I have happily e mailed throughout this onslaught on Microsoft safe in the knowledge that EPOC and Psions would be immune. I did notice four suspicious messages clearly virus ridden and deleted them. Much to my suprise I have received two recent "failed delivery" messages which appear to be infected messages I have tried to send on. This puzzles me since I have not touched a windows e mail system throughout the last week or so and my PC machine also appears completely healthy. I cannot believe these rogue e mails are infiltrating a Psion e mail address book? Can anyone cast any light on this? <<

I had exactly the same experience. Apparently the Sobig virus sends itself on automtically via email from a Windows PC, but changes the name of the sender to one or more addresses in the affected PC's address book. This means that you may get messages from ISPs saying that they detected a virus in an email sent by you, even though you know(!?) that it could not have come from your computer. This also means that you may get infected emails from people that you don't know, but who are in the address book of someone that you do know.

Cheers, Ian.

*++++++++++&

Date: 30 Aug 2003 07:50:06 +0100

From: Chris S Handley

Subject: Re: TubeRoute

Hello Alan,

> From: Alan Morris

> I've been looking for the current version of TubeRoute, but

> using the previous URLs, I keep getting access rejection

> messages.

Thats because I changed my web address! It is now:

http://cshandley.web.users.btopenworld.com/

> my version is an old beta.

I'm afraid that I have not updated it further than what you downloaded. Thats mainly because I've been writing other programs; once I've gotten them out the way, I'll get back to TubeRoute.

The good news is that while writing other programs, I've improved code modules that TubeRoute uses, and also written some new code modules that will mean I can improve TubeRoute even more. That said, the BIG job with TubeRoute is going to be caching the database for (hopefully) a big speed increase, which would then allow me to improve the algorithms used by TubeRoute (so that e.g. it knows the order of the stations along a line).

---

Chris Handley

*++++++++++&

Date: 30 Aug 2003 11:51:25 +0100

From: Michael Degn

Subject: Virus attack

Answer to Anthony Napier

> I have happily e mailed throughout this onslaught on Microsoft safe in the knowledge that EPOC and Psions would be immune. I did notice four suspicious messages clearly virus ridden and deleted them. Much to my suprise I have received two recent "failed delivery" messages which appear to be infected messages I have tried to send on. This puzzles me since I have not touched a windows e mail system throughout the last week or so and my PC machine also appears completely healthy. I cannot believe these rogue e mails are infiltrating a Psion e mail address book? Can anyone cast any light on this? <

Dear Anthony,

You're right in your assumption that EPOC is not affected by viruses. Your experience is due to the SoBig.F virus that sends itself to all email addresses in the address book on an infected computer. It furthermore uses these addresses as sender.

Your email address must have been in an infected computer and was uses to send out a virus email. When delivery failed you received a message at your email address which is real, although you never sent these emails.

The same happened to me earlier this week. Within a few minutes I've got 41 virus mails. All were intercepted by my antivirus software so no harm done. My spam rules took care of the rest and moved them to the trash bin. A closer examination of the headers revealed that they all originated from the same computer. A little later I received a few emails from some admins with "failed delivery" messages - same story as you <BG>

So no need to worry :-)

Best regards,

Michael Degn

Esbjerg, Denmark

www.degn.esenet.dk

www.pdanmark.dk

_____

Outgoing mail is certified Virus Free. Checked by Norton AntiVirus 2002

_____

*++++++++++&

Date: 30 Aug 2003 17:31:38 +0100

From: Owen H. Morgan

Subject: Re: virus attack

Howdy!

Anthony Napier wrote (> ):

> Much to my suprise I have received

> two recent "failed delivery" messages which appear

> to be infected messages I have tried to send on.

> This puzzles me since I have not touched a windows

> e mail system throughout the last week or so and

> my PC machine also appears completely healthy. I

> cannot believe these rogue e mails are

> infiltrating a Psion e mail address book? Can

> anyone cast any light on this?

No problem Tony. Most viruses select both the "to" and "from" address at random from the address book of the infected computer, so those bounced virus e-mails were originally sent from an infected computer which has your e-mail address in the mailbox. In other words, someone you have been in contact with (or even just somone who has at one time considered contacting you) has got the bug. The same applies to the virus mails that were addressed to you. The idea behind it is that you'll be less suspicious of an e-mail coming from an e-mail address you know.

Older viruses would use the address of the machine the virus was being sent from as the "from" address, but as people were becoming more aware of viruses, this meant the owner of the infected computer would very soon receive e-mails and phone calls from their friends to tell them their computer was infected and would in turn contact his or her friends and family to warn tham. Using a "from" address picked at random from the address book means that it will be longer before the owner of the infected computer realizes it's infected, so the virus gets more time to spread.

Most SMTP (Send Mail Trasfer Protocol) servers don't give a hoot what you put in the from field in your e-mail program which is why I can connect to Eastclear here in Ireland and use their SMTP server to send my outgoing e-mails which appear to be coming from my frisur.no account. Frisurf's SMTP server won't let me send mail because I'm not connecting to Frisurf, but fortunately, I have no problem retreiving my incoming e-mails from Frisurf's POP3 server.

The above mentioned situation means there is nothing at all stopping me in sending an e-mail which will appear to come from or even if I want to.

Owen

Thought for the day:

It isn't the whistle that moves the train.

Owen H. Morgan, Yacht "Naomi J.", LD-953°27.22'N 6°09.05'W

Malahide, Ireland

http://home.no.net/naomij

Phone and SMS:

In Ireland: +353 (0)87 7474173

In Norway: +47 92053097

*++++++++++&

Date: 30 Aug 2003 19:27:27 +0100

From: David Lir

Subject: Re.: Leaving the Netbook open (4 Itamar)

"Yes, the auto shut off control should do it, but it does not do it if you have any program running that prevents it from doing so, and there appear to be quite a few programs that acutally do prevent it (I am not sure which ones)."

I wonder what programs are doing this. I suspect that AlarmPlus does - sometimes. It would be good to compile a list of likely suspects.

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 19:34:08 +0100

From: David Lir

Subject: Re: Addressing directly various docs (4 Stephane)

"Menus5 from Henri Spagnolo at http://mypage.bluewin.ch/YetAnotherHomePage/indexgb.html has up to now been the only way I found allowing me to open, in a relatively simple fashion, any Data, Jotter or Word (...) document (providing it has aleady been directed at from Menus5) without having to remap any silk key."

I think that there are a number of apps that do this - ExtraBars and Macro5 come to mind.

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 19:34:10 +0100

From: David Lir

Subject: Did you know?

Did you know that you can format text in the Owner information screen? I didn't! The usual commands work for bold, italic, etc.; you can call up the font formatting options with a 'Ctrl-Shift-F' and you can even copy/paste formatted text from a Word file into the Owner info screen. Somehow, I never clued into this small simple thing. Anyone else miss this? I was glad to find this out since I prefer to have the "PLEASE RETURN FOR CA$H REWARD!!!" line in bright red and the word 'CA$H' in green and my phone number in bold! ;) Also, it looks nicer. I guess that the Owner info screen is using Word after all?

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 19:34:11 +0100

From: David Lir

Subject: Re: Is Palmtop Money the worst accounting program ever? (4 Chris)

"Over a year ago I sent Palmtop & TomTom, a short but precise report on my problem, and the details which I believed indicated this to be a bug in Money. After several more emails, I finally recieved a reply saying they would look at it - and then absolutely nothing since! I have to say I am fairly shocked at Palmtop/TomTom's lack of any kind of real reply."

After making *numerous* online purchases I'm no longer surprised when a company fails to reply to an email enquiry. I am only surprised when I do receive a timely and *relevant* reply!

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 19:34:12 +0100

From: David Lir

Subject: Re: Zaurus C700 series (4 Mike W.)

"Word & Excel files do not require conversion which can be a boon, however need to allow for the much larger file sizes when calculating the storage requirements, if you usually store 250 MB on your Psion you will probably need 2.5 GB on the Zaurus."

That alone would *absolutely* rule a Zaurus out for me. Why are the file sizes so big?

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 19:34:14 +0100

From: David Lir

Subject: Re: Cycle through apps (4 Ulrich)

"When running StickyKeys, a very good app when lying in bed and having to type with one hand only, the cycling through all open apps via Macro5 is not working any more.

...

Is there a task cycling program around that I am not aware of - it must work together with StickyKeys, of course."

Hi Ulrich,

There may be others, but EPOC Task Manager's task-switcher (which is the best out there, IMO) works with StickyKeys. However, the first time you switch into an app you will have to push the Ctrl key *twice* for it to take. It's a bit of a nuisance, really; but with the 5mx's smallish keyboard I felt that having StickyKeys enabled was necessary enough to make this small nuisance worth it. However, on my MnB I find I have no need for SK due to the excellent and large keyboard.

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 19:34:15 +0100

From: David Lir

Subject: Re: Fn and Menu keys on the nB? (4 Guillaume)

"I've asked some months ago if anyone had ever succeeded in switching with a software or exorcist prayer the stupidely inverted Fn and Menu key of the otherwise splendid nB. Has anyone?

And is it possible to get rid of some of the components of the nB ROM? A pity that this computer has so few RAM and that the expension ram is so expensive."

Sita is selling the RAM upgrade for $127 US (including shipping anywhere) - it is well worth the expenditure! As for reversing Fn and Menu - would something like Remapper work?

------------------------

David Lir - \\:>{o>

*++++++++++&

Date: 30 Aug 2003 20:48:01 +0100

From: Kevin Thorne

Subject: Longer lasting cells

Chris Handley wrote:

Aha - I feel the great battery debate from way back when is about to resurface! I do the same as you but I've also heard that even Li-ions benefit from an occasional full discharge. I deliberately let mine run right down about once a month (with a full backup first of C drive naturally). I guess I must be doing something right (see below):

My S7 is now 3½ years old and still on its original main battery (and backup cell, come to think of it!) I still get around 6 hours average on a full cycle of fully charged to fully discharged. This is with around 1 hour use of infra-red (to my Psion Travel Modem or to my 9210 Communicator) and I also use a Microdrive in D drive (which is known to use more power than a CF card). Now, what I'd really like to know (and maybe someone has even come up with a definitive set of figures having nothing better to do on a wet Sunday) is:

1 How much less running time does one get using a Microdrive rather than a CF card?

2 How much less running time doe one get using a S7/netBook with the extra RAM DIMM fitted?

Regards

Kevin Thorne

*++++++++++&

Date: 30 Aug 2003 22:57:59 +0100

From: Alan Morris

Subject: Re: Revo Battery Solution

Owen H. Morgan wrote:-

<< My solution to the Revo/Mako battery problem is very simple:

1. I never ever charge the machine whilst it is switched on. >>

My Revo+ is always switched on when it's being charged so that ChaDis can warn me when the batteries are being overcharged.

<< 2. I never ever partially charge the machine. When I charge the machine, I always give it a complete charge of at least 8 hours. >>

I use mine most days, sometimes I even have to switch it off as the battery life reported by ChaDis is less than 1 hour. I'll even charge it if it's only a few % down, if I expect full use the next day.

<< 3. I trust the red and green charging lights and disregard what the software is telling me. (This is the advice given by Psion.) >>

ChaDis agrees with the charging lights and if the red one goes off before it's 100% and I'm in a hurry, I'll switch off the PSU and back on again to restore high level charging.

<< 4. I make sure to use a power supply which is rated at at least 500mA. (In fact, I charge my Mako/Revo from a 6V 12Ah lead acid battery.) >>

I always use the PSU that came with the Revo+.

I'm not saying that Owen is wrong, in fact are there a number of build levels (or batches) and those with the faulty level/batch are the ones with problems?