More details here: http://news.cnet.com/8301-1009_3-10185517-83.html

ave had.

We hope you have a wonderful Thanksgiving, filled with family, friends, and good food!

We will return to our normal hours on Friday, Nov. 23. Normal hours are:

Monday - Saturday: 9:00 AM to Midnight, EST Sunday: 2:00 PM until Midnight, EST

Happy Holidays from jellico.com, Inc.

For instructions on how to look to see what your settings are and change them if necessary, see http://www.jellico.com/changes.html

This problem appears to be nationwide. Service is being restored as quickly as possible. As of 1:30 this afternoon, 72% of the affected routes have been restored. Service in the remaining areas should be restored later today.

To download the new web accelerator software, go to our web site: and scroll down about half way down the page. You will see a banner ad that says: "No more World Wide Wait". Click on that banner and read the info on the page you get. Near the bottom of that page click on the link to download the software. A box will come up that asks if you want to Save the file or Open it. Choose to Open it and it should download to your computer and install.

The first time you use the accelerator, you'll get a little window asking for your accelerator username and password. You should type in the same information you use to log on to the internet (username@jellico.com or username@jellico.net along with your password for your account).

As always, if you have questions or problems please call our office.

This e-mail is NOT from us. We would never sign an e-mail to our customers "Jellico Abuse Department" or "The Jellico Administration Team". If you ever receive an e-mail that says it is from us and you have any doubts what so ever do feel free to call our office and ask about it.

November 23, 2005:   One of the companies we get our phone numbers through is discontinuing some of it's numbers effective December 1, 2005. If your computer dials 562-4503 (Lafollette, TN) you will need to change that number to 352-1004. If your computer dials 745-4106 (Athens, TN) you will need to change that number to 252-1181. If you need assistance making this change on your computer, please call our office.

For instructions on how to look to see what your settings are and change them if necessary, see http://www.jellico.com/changes.html

We apologise for the inconvenience.

The phone company is working to repair the problem as quickly as they can.

Currently doing the rounds via spam is an apparent promotion for Microsoft AntiSpyware (“Download the new beta software from Microsoft today”) comprising a copy of Microsoft's Spyware index page with the AntiSpyware download links redirected to the attacker’s server—ftp.pisem.net in the sample I received, but this most likely changes.

Should you be unfortunate enough to download and run the linked executable, you’ll be getting a downloader trojan controlled by 1.dns10.peterhost.ru, installing a password sniffer that sends sensitive network traffic to publically-accessible web sites that are currently happily filling up with Hotmail and internet banking passwords.

So just to re-iterate what every security site says in this situation: Microsoft does not send e-mail promoting its downloads like this, and one should not generally click through links in e-mail, especially not to downloadable programs.

There’s actually a worse version going around under the guise of a BBC World news link titled “Attention !!! George W Bush is dead”, which if clicked through goes straight to an Internet Explorer security hole exploit. So should you be unlucky enough to click the link with IE as your default browser you get the same password-stealing trojan installed from bflog.net. (Do not visit this site in IE; even the index page currently contains an exploit.)

Since our mail server crashed on April 24, we don't yet have our full spam filters adapted over to the new system yet. You may have noticed an increase of spam in your mailbox. We will have these adapted over as soon as possible.

we have logged your IP-address on more than 40 illegal Websites.

Important: Please answer our questions! The list of questions are attached.

Yours faithfully,
M. John Stellford

++-++ Federal Bureau of Investigation -FBI-
++-++ 935 Pennsylvania Avenue, NW, Room 2130
++-++ Washington, DC 20535
++-++ (202) 324-3000

During the times we are closed we will check messages on the answering machine.

We want to wish everyone a Merry Christmas! and a Happy New Year!

About the W32/Zafi.D Worm: W32/Zafi.D is an email worm. This worm will infect Windows systems. The worm spreads through email. Since the worm uses Christmas greetings in the email it is expected to spread further.

The worm arrives with the following subject: Merry Christmas!

The spoofed 'From' address of the infected mail will be picked up randomly from the infected system. The body of the infected mail contains message connected to Holidays or random characters. It carries an infected attachment having a set of filenames with single or double extension. The second extension of the infected attachment can be .PIF, .BAT, .ZIP, .COM or .CMD. (Note: jellico.com's virus scanning system should catch these but be wary anyway). The name of the infected attachment will be associated with Christmas greetings. Due to this users are tempted to click the attachment.

You can read more information about this worm at: http://www.protectorplus.com/virusinfo/worms/zafid.htm

We apologise for the inconvenience.

From: administration@jellico.com
Subject: [deleted attachment] E-mail warning
Date: Fri, 29 Oct 2004 17:27:12 -0500
Dear user of "Jellico.com" mailing system,

Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions.

Advanced details can be found in attached file.

Best wishes,
The Jellico.com team http://www.jellico.com

:)
:))

It carries an infected attachment having a file name 'price' or 'joke', and the extension of the infected attachment can be .EXE, .SCR .COM or .CPL. (This means our virus filters should catch it but be wary anyway).
You can read more information about this worm at:
http://www.protectorplus.com/virus_info/worms/bagleat.htm

• http://www.scumware.com
• http://www.pchell.com/support/spyware.shtml
• http://www.adware.info/

Your e-mail account was used to send a huge amount of unsolicited email during this week. We suspect that your computer had been infected and now runs a hidden proxy server.

Please follow instructions in order to keep your computer safe. Virtually yours,
jellico.com support team.

This E-mail WAS NOT sent by jellico.com If you receive such an E-mail DO NOT open the attached file. It is undoubtedly a virus.

About the W32/Mydoom.O Worm:

W32/Mydoom.O is an email worm. All Windows Operating systems are susceptible to this worm. The worm spreads through email and shared network drives.

The subject of the infected email will be either blank or about the delivery of an email or from a pre-defined list maintained by the worm. The body of the infected email describes about the email delivery details from the Administrator. The 'From' address of the infected email is spoofed.

The worm carries an attachment. The name of the infected attachment will be recipient's domain name, username or from a pre-defined list. The infected attachment will have any one of the following extensions;

EXE, COM, SCR, PIF, BAT or CMD

You can read more information about this worm at: http://www.protectorplus.com/virus_info/worms/mydoomo.htm

During this time you will not be able to logon to the Internet.

We apologise for the inconvenience, but this will make things better because our data line will then stop going down unexpectedly.

Thanks for your patience. Sorry we weren't able to give you more notice, but we just found out about this ourselves.

The campbellcounty.com mail server is not protected yet. It uses a different mail server software.

From: support@copperhill.com
To: username removed@copperhill.com
Sent: Tuesday, March 02, 2004 11:57 PM
Subject: Important notify about your e-mail account.

Dear user of Copperhill.com,
Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information.

For further details see the attach.

Best wishes,
The Copperhill.com team

Here's another variation of the same thing:
Dear user of Jellico.net,

Our antivirus software has detected a large ammount of viruses outgoing from your email account, you may use our free anti-virus tool to clean up your computer software.

Further details can be obtained from attached file.

In order to read the attach you have to use the following password: 07777.

Kind regards,
The Jellico.net team

Known as "MyDoom" or "Novarg," the worm uses a fairly new tactic to get unsuspecting computer users to diffuse its malicious code. The worm is contained in e-mails with random senders' addresses and subject lines.

While the body of the e-mail varies, it usually includes what appears to be an error message, such as: "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment."

While many computer users are savvy about not opening executable files or other attachments that may contain viruses, the latest worm masks itself as an innocuous text document or a file that the computer appears unable to read.

"This one is almost begging you to click on the attachment," said Sharon Ruckman, the head of anti-virus firm Symantec's security response team.

How do you get these? Sometimes your kids download them, some of these come bundled in with other programs (such as Kazaa) and sometimes you can get these just from being on the Internet. They can be downloaded to your computer without your being aware of it.

We suggest that folks download software to their computer that can find these things on your system and remove them. There are lots of software programs that can do this but one that we use here at the office and can suggest is "Spybot: Search and Destroy". You can download this program from:

Don't wait until you get infected with one of these. Just yesterday we had a customer whose browser (Internet Explorer) was hijacked and he could not get to ANY web sites so it was too late for him to download it then.

Treat it like your anti-virus software. Keep it (Spybot) updated and use it regularly to scan your system. You might be surprised at what you find lurking there!

On another note: we have reduced the price of our dedicated dial-ups. Our normal dial-up accounts are "Unlimited Active Use" which means that you can stay on as long as you are actively using the connection. With a dedicated dial-up, however, you have the right to stay connected 24/7 and our software will not disconnect you, we won't hassle you about being connected when you are not using it, nor will you ever see a charge on your bill for having being connected to us when you are not using the connection. Our dedicated 56K dialup was $99.95 per month, it is now $69.95 per month. Our dedicated ISDN dialup has been reduced to $99.95 per month from $199.95 per month. Plus with a dedicated dialup you get our dialup accelerator broadband software at no additional charge, an additional savings of $5.00 per month. For more information, call our office at 784-2000 or 1-800-895-5593 or visit

And lastly: we truly want to be the best ISP in your area. We try hard, with office hours until midnight seven days a week and friendly knowledgeable tech support personel who answer the phone when you call (rather than keeping you waiting on hold for an hour just to speak to someone) and who work with you to solve your problems. We would like to get some feedback from our members on how we are doing. What do you like about our service? What do you dislike about it? Are there any features we currently do not offer that would be important to you? What can we do better? If you care to respond to this, please e-mail your response to service@jellico.com

We apologise for the inconvenience, but are trying to improve service in your area.

1) On the day of the upgrade, our service will be down for several hours.

2) After the upgrade is complete, our DNS server addresses will change. If you are unable to access web pages or your mail server afterwards you will need to change the DNS Server numbers in your settings. The new numbers will be:

Primary DNS: 67.130.252.4
Secondary (Alternate) DNS: 67.130.252.8

Do not change these ahead of time as they will not work before our upgrade. As always, if you need help in making these changes please call our office.