| 1 |
On Sun, Dec 14, 2003 at 06:57:16AM +0100, John Nilsson wrote: |
| 2 |
> The virus disables antivirus programs, and deletes all current and |
| 3 |
> future traces of it self from the victims mailbox (it actually connects |
| 4 |
> to the pop3 server to do this). |
| 5 |
Only on windows of course. |
| 6 |
|
| 7 |
> The only list I am currently active on is this. While hard to believe |
| 8 |
> the most logical conclusion is that some gentoo-dev subscribers has |
| 9 |
> been infected. |
| 10 |
You neglect the spread mechanism here. Given that the worm forges it's |
| 11 |
source address to a random value, the ONLY requirement to recieve an |
| 12 |
infected email from somebody is that they have have at some point |
| 13 |
recieved an email from you (either directly or via some mailing list) in |
| 14 |
the past, and they still have your email on their system. |
| 15 |
|
| 16 |
> Most of you probably has spamfilters that would hide this mail from |
| 17 |
> you, but shurley if it comes from gentoo-dev more people then I would |
| 18 |
> get these mails. |
| 19 |
Plenty of us get viral and other spam on a daily basis (for several |
| 20 |
months now), and even bounce messages for other virii that forge our |
| 21 |
addresses (even our @gentoo.org ones). Set up some filtering for |
| 22 |
yourself I use qmail-scanner + spamassassin + procmail to handle all of |
| 23 |
my stuff. |
| 24 |
|
| 25 |
-- |
| 26 |
Robin Hugh Johnson |
| 27 |
E-Mail : robbat2@××××××××××××××.net |
| 28 |
Home Page : http://www.orbis-terrarum.net/?l=people.robbat2 |
| 29 |
ICQ# : 30269588 or 41961639 |
| 30 |
GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85 |
Archives