more worms

more worms

[Gregory Nowak]

Hi all,

I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
Greg



>From carpy@mail.ru Mon May 13 02:37:54 2002
Return-Path: <carpy@mail.ru>
Delivered-To: greg@romualt.dhs.org
Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
Received: from mx9.mail.ru (194.67.57.19)
  by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
	by mx9.mail.ru with smtp (Exim SMTP.9)
	id 1775u8-000Erg-00
	for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
From: mailman-owner <mailman-owner@braille.uwo.ca.>
To: greg@romualt.dhs.org
Subject: A special  good tool
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary=AP7383eS3L5oq9gt0
Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
Date: Mon, 13 May 2002 06:49:40 +0400
Status: RO
Content-Length: 169918
Lines: 2345



The following is from my /var/adm/messages.


May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715

Re: more worms

[Toby Fisher]

Now it would be really funny, if there weren't Windows users on here that
could be affected by this, but it does look like someone is trying to
infect the list, and must have read access to it somewhere to get the
email address.

Cheers.

-- 
Toby Fisher	Email: toby@g0ucu.freeserve.co.uk
Tel.: +44(0)1480 417272	Mobile: +44(0)7974 363239
ICQ: #61744808
   Please avoid sending me Word or PowerPoint attachments.
   See http://www.fsf.org/philosophy/no-word-attachments.html

Re: more worms

[Alex Snow]

Yeah I got a wierd one yesterday, some guy telling me that i'd like the game
he atached, a winblows .exe file.  I don't know if he thinks I'm stupid or
something but it's eather a virus, or porn of which both I don't want.
----- Original Message -----
From: "Gregory Nowak" <greg@romualt.dhs.org>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 12:19 AM
Subject: more worms


> Hi all,
>
> I just wanted to say that the earlier incident where Kerry's e-mail was
faked, and a worm was sent to the list was not the only one. I've just
recieved a private e-mail with a faked address from
mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers
below along with the entry from my qmail messages.
> Greg
>
>
>
> >From carpy@mail.ru Mon May 13 02:37:54 2002
> Return-Path: <carpy@mail.ru>
> Delivered-To: greg@romualt.dhs.org
> Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> Received: from mx9.mail.ru (194.67.57.19)
>   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com
([146.115.123.205] helo=Yshdx)
> by mx9.mail.ru with smtp (Exim SMTP.9)
> id 1775u8-000Erg-00
> for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> From: mailman-owner <mailman-owner@braille.uwo.ca.>
> To: greg@romualt.dhs.org
> Subject: A special  good tool
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=AP7383eS3L5oq9gt0
> Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> Date: Mon, 13 May 2002 06:49:40 +0400
> Status: RO
> Content-Length: 169918
> Lines: 2345
>
>
>
> The following is from my /var/adm/messages.
>
>
> May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes
170583 from <carpy@mail.ru> qp 25741 uid 1005
> May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169:
msg 245715 to local greg@romualt.dhs.org
> May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10
remote 0/20
> May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success:
did_0+0+1/
> May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10
remote 0/20
> May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
>
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
>

Re: more worms

[Gregory Nowak]

Did it have the faked address of someone from this list?
Greg


On Mon, May 13, 2002 at 06:36:41AM -0400, Alex Snow wrote:
> Yeah I got a wierd one yesterday, some guy telling me that i'd like the game
> he atached, a winblows .exe file.  I don't know if he thinks I'm stupid or
> something but it's eather a virus, or porn of which both I don't want.
> ----- Original Message -----
> From: "Gregory Nowak" <greg@romualt.dhs.org>
> To: <speakup@braille.uwo.ca>
> Sent: Monday, May 13, 2002 12:19 AM
> Subject: more worms
> 
> 
> > Hi all,
> >
> > I just wanted to say that the earlier incident where Kerry's e-mail was
> faked, and a worm was sent to the list was not the only one. I've just
> recieved a private e-mail with a faked address from
> mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers
> below along with the entry from my qmail messages.
> > Greg
> >
> >
> >
> > >From carpy@mail.ru Mon May 13 02:37:54 2002
> > Return-Path: <carpy@mail.ru>
> > Delivered-To: greg@romualt.dhs.org
> > Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> > Received: from mx9.mail.ru (194.67.57.19)
> >   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com
> ([146.115.123.205] helo=Yshdx)
> > by mx9.mail.ru with smtp (Exim SMTP.9)
> > id 1775u8-000Erg-00
> > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> > From: mailman-owner <mailman-owner@braille.uwo.ca.>
> > To: greg@romualt.dhs.org
> > Subject: A special  good tool
> > MIME-Version: 1.0
> > Content-Type: multipart/alternative;
> > boundary=AP7383eS3L5oq9gt0
> > Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> > Date: Mon, 13 May 2002 06:49:40 +0400
> > Status: RO
> > Content-Length: 169918
> > Lines: 2345
> >
> >
> >
> > The following is from my /var/adm/messages.
> >
> >
> > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes
> 170583 from <carpy@mail.ru> qp 25741 uid 1005
> > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169:
> msg 245715 to local greg@romualt.dhs.org
> > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10
> remote 0/20
> > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success:
> did_0+0+1/
> > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10
> remote 0/20
> > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> >
> >
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> >
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Hoax virus was Re: more worms

[Toby Fisher]

On Mon, 13 May 2002, Alex Snow wrote:

> Yeah I got a wierd one yesterday, some guy telling me that i'd like the game
> he atached, a winblows .exe file.  I don't know if he thinks I'm stupid or
> something but it's eather a virus, or porn of which both I don't want.

I received a message today saying that there was this really distructive
virus, not detected by Norton etc, that stayed quiet for 14 days and then
activated.  It was called jdbgmgr.exe and I was urged to delte it.

Under no circumstances do this, it's part of Winblows and may break your
system, spread the word.

Cheers.

-- 
Toby Fisher	Email: toby@g0ucu.freeserve.co.uk
Tel.: +44(0)1480 417272	Mobile: +44(0)7974 363239
ICQ: #61744808
   Please avoid sending me Word or PowerPoint attachments.
   See http://www.fsf.org/philosophy/no-word-attachments.html

Re: more worms

[Igor Gueths]

Hi Greg. It seems that someone is using a server in Russia, and also using Rcn
----- Original Message ----- 
From: Gregory Nowak <greg@romualt.dhs.org>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 12:19 AM
Subject: more worms


> Hi all,
> 
> I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
> Greg
> 
> 
> 
> From carpy@mail.ru Mon May 13 02:37:54 2002
> Return-Path: <carpy@mail.ru>
> Delivered-To: greg@romualt.dhs.org
> Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> Received: from mx9.mail.ru (194.67.57.19)
>   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
> by mx9.mail.ru with smtp (Exim SMTP.9)
> id 1775u8-000Erg-00
> for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> From: mailman-owner <mailman-owner@braille.uwo.ca.>
> To: greg@romualt.dhs.org
> Subject: A special  good tool
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=AP7383eS3L5oq9gt0
> Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> Date: Mon, 13 May 2002 06:49:40 +0400
> Status: RO
> Content-Length: 169918
> Lines: 2345
> 
> 
> 
> The following is from my /var/adm/messages.
> 
> 
> May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
> May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
> May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
> May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
> May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: more worms

[Igor Gueths]

And the msg actually originated from a Massachusetts subnet.
----- Original Message ----- 
From: Gregory Nowak <greg@romualt.dhs.org>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 12:19 AM
Subject: more worms


> Hi all,
> 
> I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
> Greg
> 
> 
> 
> From carpy@mail.ru Mon May 13 02:37:54 2002
> Return-Path: <carpy@mail.ru>
> Delivered-To: greg@romualt.dhs.org
> Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> Received: from mx9.mail.ru (194.67.57.19)
>   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
> by mx9.mail.ru with smtp (Exim SMTP.9)
> id 1775u8-000Erg-00
> for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> From: mailman-owner <mailman-owner@braille.uwo.ca.>
> To: greg@romualt.dhs.org
> Subject: A special  good tool
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=AP7383eS3L5oq9gt0
> Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> Date: Mon, 13 May 2002 06:49:40 +0400
> Status: RO
> Content-Length: 169918
> Lines: 2345
> 
> 
> 
> The following is from my /var/adm/messages.
> 
> 
> May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
> May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
> May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
> May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
> May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: more worms

[Gregory Nowak]

Yes. That much is evident from looking at the headers.
Greg


On Mon, May 13, 2002 at 03:48:08PM -0400, Igor Gueths wrote:
> Hi Greg. It seems that someone is using a server in Russia, and also using Rcn
> ----- Original Message ----- 
> From: Gregory Nowak <greg@romualt.dhs.org>
> To: <speakup@braille.uwo.ca>
> Sent: Monday, May 13, 2002 12:19 AM
> Subject: more worms
> 
> 
> > Hi all,
> > 
> > I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
> > Greg
> > 
> > 
> > 
> > From carpy@mail.ru Mon May 13 02:37:54 2002
> > Return-Path: <carpy@mail.ru>
> > Delivered-To: greg@romualt.dhs.org
> > Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> > Received: from mx9.mail.ru (194.67.57.19)
> >   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
> > by mx9.mail.ru with smtp (Exim SMTP.9)
> > id 1775u8-000Erg-00
> > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> > From: mailman-owner <mailman-owner@braille.uwo.ca.>
> > To: greg@romualt.dhs.org
> > Subject: A special  good tool
> > MIME-Version: 1.0
> > Content-Type: multipart/alternative;
> > boundary=AP7383eS3L5oq9gt0
> > Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> > Date: Mon, 13 May 2002 06:49:40 +0400
> > Status: RO
> > Content-Length: 169918
> > Lines: 2345
> > 
> > 
> > 
> > The following is from my /var/adm/messages.
> > 
> > 
> > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
> > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
> > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
> > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
> > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> > 
> > 
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: more worms

[Gregory Nowak]

Now that wasn't as appearent. How do you know that?
Greg


On Mon, May 13, 2002 at 03:49:26PM -0400, Igor Gueths wrote:
> And the msg actually originated from a Massachusetts subnet.
> ----- Original Message ----- 
> From: Gregory Nowak <greg@romualt.dhs.org>
> To: <speakup@braille.uwo.ca>
> Sent: Monday, May 13, 2002 12:19 AM
> Subject: more worms
> 
> 
> > Hi all,
> > 
> > I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
> > Greg
> > 
> > 
> > 
> > From carpy@mail.ru Mon May 13 02:37:54 2002
> > Return-Path: <carpy@mail.ru>
> > Delivered-To: greg@romualt.dhs.org
> > Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> > Received: from mx9.mail.ru (194.67.57.19)
> >   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
> > by mx9.mail.ru with smtp (Exim SMTP.9)
> > id 1775u8-000Erg-00
> > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> > From: mailman-owner <mailman-owner@braille.uwo.ca.>
> > To: greg@romualt.dhs.org
> > Subject: A special  good tool
> > MIME-Version: 1.0
> > Content-Type: multipart/alternative;
> > boundary=AP7383eS3L5oq9gt0
> > Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> > Date: Mon, 13 May 2002 06:49:40 +0400
> > Status: RO
> > Content-Length: 169918
> > Lines: 2345
> > 
> > 
> > 
> > The following is from my /var/adm/messages.
> > 
> > 
> > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
> > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
> > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
> > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
> > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> > 
> > 
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: more worms

[Alex Snow]

He could have looked it up in the database of IPs.
----- Original Message -----
From: "Gregory Nowak" <greg@romualt.dhs.org>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 4:32 PM
Subject: Re: more worms


> Now that wasn't as appearent. How do you know that?
> Greg
>
>
> On Mon, May 13, 2002 at 03:49:26PM -0400, Igor Gueths wrote:
> > And the msg actually originated from a Massachusetts subnet.
> > ----- Original Message -----
> > From: Gregory Nowak <greg@romualt.dhs.org>
> > To: <speakup@braille.uwo.ca>
> > Sent: Monday, May 13, 2002 12:19 AM
> > Subject: more worms
> >
> >
> > > Hi all,
> > >
> > > I just wanted to say that the earlier incident where Kerry's e-mail
was faked, and a worm was sent to the list was not the only one. I've just
recieved a private e-mail with a faked address from
mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers
below along with the entry from my qmail messages.
> > > Greg
> > >
> > >
> > >
> > > From carpy@mail.ru Mon May 13 02:37:54 2002
> > > Return-Path: <carpy@mail.ru>
> > > Delivered-To: greg@romualt.dhs.org
> > > Received: (qmail 25741 invoked from network); 13 May 2002
02:37:50 -0000
> > > Received: from mx9.mail.ru (194.67.57.19)
> > >   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> > > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com
([146.115.123.205] helo=Yshdx)
> > > by mx9.mail.ru with smtp (Exim SMTP.9)
> > > id 1775u8-000Erg-00
> > > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> > > From: mailman-owner <mailman-owner@braille.uwo.ca.>
> > > To: greg@romualt.dhs.org
> > > Subject: A special  good tool
> > > MIME-Version: 1.0
> > > Content-Type: multipart/alternative;
> > > boundary=AP7383eS3L5oq9gt0
> > > Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> > > Date: Mon, 13 May 2002 06:49:40 +0400
> > > Status: RO
> > > Content-Length: 169918
> > > Lines: 2345
> > >
> > >
> > >
> > > The following is from my /var/adm/messages.
> > >
> > >
> > > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> > > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715:
bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> > > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery
169: msg 245715 to local greg@romualt.dhs.org
> > > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10
remote 0/20
> > > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169:
success: did_0+0+1/
> > > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10
remote 0/20
> > > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> > >
> > >
> > > _______________________________________________
> > > Speakup mailing list
> > > Speakup@braille.uwo.ca
> > > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> >
> >
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
>

Re: more worms

[Igor Gueths]

Hi Greg. You will notice within the numbers something like cable.ma.rcn.com or xxx-xxx-xxx.ma.cable.rcn.com. MA-abrieviation Massachusetts. I don't remember the exact header, but it was something along those lines. 
----- Original Message ----- 
From: Gregory Nowak <greg@romualt.dhs.org>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 4:32 PM
Subject: Re: more worms


> Now that wasn't as appearent. How do you know that?
> Greg
> 
> 
> On Mon, May 13, 2002 at 03:49:26PM -0400, Igor Gueths wrote:
> > And the msg actually originated from a Massachusetts subnet.
> > ----- Original Message ----- 
> > From: Gregory Nowak <greg@romualt.dhs.org>
> > To: <speakup@braille.uwo.ca>
> > Sent: Monday, May 13, 2002 12:19 AM
> > Subject: more worms
> > 
> > 
> > > Hi all,
> > > 
> > > I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
> > > Greg
> > > 
> > > 
> > > 
> > > From carpy@mail.ru Mon May 13 02:37:54 2002
> > > Return-Path: <carpy@mail.ru>
> > > Delivered-To: greg@romualt.dhs.org
> > > Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> > > Received: from mx9.mail.ru (194.67.57.19)
> > >   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> > > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
> > > by mx9.mail.ru with smtp (Exim SMTP.9)
> > > id 1775u8-000Erg-00
> > > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> > > From: mailman-owner <mailman-owner@braille.uwo.ca.>
> > > To: greg@romualt.dhs.org
> > > Subject: A special  good tool
> > > MIME-Version: 1.0
> > > Content-Type: multipart/alternative;
> > > boundary=AP7383eS3L5oq9gt0
> > > Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> > > Date: Mon, 13 May 2002 06:49:40 +0400
> > > Status: RO
> > > Content-Length: 169918
> > > Lines: 2345
> > > 
> > > 
> > > 
> > > The following is from my /var/adm/messages.
> > > 
> > > 
> > > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> > > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> > > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
> > > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
> > > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
> > > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
> > > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> > > 
> > > 
> > > _______________________________________________
> > > Speakup mailing list
> > > Speakup@braille.uwo.ca
> > > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> > 
> > 
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: more worms

[Gregory Nowak]

Ah well, didn't look at the headers too closely, just enough to see where it originated. 
Greg


On Mon, May 13, 2002 at 05:47:00PM -0400, Igor Gueths wrote:
> Hi Greg. You will notice within the numbers something like cable.ma.rcn.com or xxx-xxx-xxx.ma.cable.rcn.com. MA-abrieviation Massachusetts. I don't remember the exact header, but it was something along those lines. 
> ----- Original Message ----- 
> From: Gregory Nowak <greg@romualt.dhs.org>
> To: <speakup@braille.uwo.ca>
> Sent: Monday, May 13, 2002 4:32 PM
> Subject: Re: more worms
> 
> 
> > Now that wasn't as appearent. How do you know that?
> > Greg
> > 
> > 
> > On Mon, May 13, 2002 at 03:49:26PM -0400, Igor Gueths wrote:
> > > And the msg actually originated from a Massachusetts subnet.
> > > ----- Original Message ----- 
> > > From: Gregory Nowak <greg@romualt.dhs.org>
> > > To: <speakup@braille.uwo.ca>
> > > Sent: Monday, May 13, 2002 12:19 AM
> > > Subject: more worms
> > > 
> > > 
> > > > Hi all,
> > > > 
> > > > I just wanted to say that the earlier incident where Kerry's e-mail was faked, and a worm was sent to the list was not the only one. I've just recieved a private e-mail with a faked address from mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers below along with the entry from my qmail messages.
> > > > Greg
> > > > 
> > > > 
> > > > 
> > > > From carpy@mail.ru Mon May 13 02:37:54 2002
> > > > Return-Path: <carpy@mail.ru>
> > > > Delivered-To: greg@romualt.dhs.org
> > > > Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
> > > > Received: from mx9.mail.ru (194.67.57.19)
> > > >   by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
> > > > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([146.115.123.205] helo=Yshdx)
> > > > by mx9.mail.ru with smtp (Exim SMTP.9)
> > > > id 1775u8-000Erg-00
> > > > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
> > > > From: mailman-owner <mailman-owner@braille.uwo.ca.>
> > > > To: greg@romualt.dhs.org
> > > > Subject: A special  good tool
> > > > MIME-Version: 1.0
> > > > Content-Type: multipart/alternative;
> > > > boundary=AP7383eS3L5oq9gt0
> > > > Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
> > > > Date: Mon, 13 May 2002 06:49:40 +0400
> > > > Status: RO
> > > > Content-Length: 169918
> > > > Lines: 2345
> > > > 
> > > > 
> > > > 
> > > > The following is from my /var/adm/messages.
> > > > 
> > > > 
> > > > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
> > > > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes 170583 from <carpy@mail.ru> qp 25741 uid 1005
> > > > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169: msg 245715 to local greg@romualt.dhs.org
> > > > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote 0/20
> > > > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success: did_0+0+1/
> > > > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote 0/20
> > > > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715
> > > > 
> > > > 
> > > > _______________________________________________
> > > > Speakup mailing list
> > > > Speakup@braille.uwo.ca
> > > > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> > > 
> > > 
> > > _______________________________________________
> > > Speakup mailing list
> > > Speakup@braille.uwo.ca
> > > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> > 
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: Hoax virus was Re: more worms

[Adam Myrow]

I got a warning about that hoax at work.  That's really dirty!  With all
these real viruses doing real damage, somebody takes advantage of people's
ignorance and has them deleting part of their system.  With all these
viruses going around, I sometimes wonder if the antivirus software vendors
perhaps write viruses in their spare time so they can sell more software?
Maybe I'm being paranoid, but there are just too many viruses out there to
be believed!  Between that and spam, I'm just about to lose my mind!

Re: Hoax virus was Re: more worms

[Igor Gueths]

Well its a good thing we all use Linux instead of being shafted by Microcrap diseases right? 
----- Original Message ----- 
From: Adam Myrow <myrow@eskimo.com>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 7:02 PM
Subject: Re: Hoax virus was Re: more worms


> I got a warning about that hoax at work.  That's really dirty!  With all
> these real viruses doing real damage, somebody takes advantage of people's
> ignorance and has them deleting part of their system.  With all these
> viruses going around, I sometimes wonder if the antivirus software vendors
> perhaps write viruses in their spare time so they can sell more software?
> Maybe I'm being paranoid, but there are just too many viruses out there to
> be believed!  Between that and spam, I'm just about to lose my mind!
> 
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: Hoax virus was Re: more worms

[Toby Fisher]

On Mon, 13 May 2002, Adam Myrow wrote:

> I got a warning about that hoax at work.  That's really dirty!  With all
> these real viruses doing real damage, somebody takes advantage of people's
> ignorance and has them deleting part of their system.  With all these
> viruses going around, I sometimes wonder if the antivirus software vendors
> perhaps write viruses in their spare time so they can sell more software?

You could be right, I wouldn't like to comment.  However it's not the
first time this sort of thing has gone round.  This one is just something
to do with java display, or it might be a java applette or something like
that, but the first  one of its type, sulf something, was to do with being
able to save files with names longer than 8.3.

Cheers.

-- 
Toby Fisher	Email: toby@g0ucu.freeserve.co.uk
Tel.: +44(0)1480 417272	Mobile: +44(0)7974 363239
ICQ: #61744808
   Please avoid sending me Word or PowerPoint attachments.
   See http://www.fsf.org/philosophy/no-word-attachments.html

Re: more worms

[Octavian Rasnita]

That site (mail.ru) is in russian language.
The server doesn't support relaying if someone doesn't have an account
there.
So I think it is somebody who knows russian language.
... or there is an english version of the site and I couldn't find it.

Teddy,
orasnita@home.ro

----- Original Message -----
From: "Gregory Nowak" <greg@romualt.dhs.org>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 7:19 AM
Subject: more worms


Hi all,

I just wanted to say that the earlier incident where Kerry's e-mail was
faked, and a worm was sent to the list was not the only one. I've just
recieved a private e-mail with a faked address from
mailman-owner@braille.uwo.ca with a similar worm. I'm including the headers
below along with the entry from my qmail messages.
Greg



>From carpy@mail.ru Mon May 13 02:37:54 2002
Return-Path: <carpy@mail.ru>
Delivered-To: greg@romualt.dhs.org
Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 -0000
Received: from mx9.mail.ru (194.67.57.19)
  by softdnserror with SMTP; 13 May 2002 02:37:50 -0000
Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com
([146.115.123.205] helo=Yshdx)
by mx9.mail.ru with smtp (Exim SMTP.9)
id 1775u8-000Erg-00
for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400
From: mailman-owner <mailman-owner@braille.uwo.ca.>
To: greg@romualt.dhs.org
Subject: A special  good tool
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=AP7383eS3L5oq9gt0
Message-Id: <E1775u8-000Erg-00@mx9.mail.ru>
Date: Mon, 13 May 2002 06:49:40 +0400
Status: RO
Content-Length: 169918
Lines: 2345



The following is from my /var/adm/messages.


May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715
May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: bytes
170583 from <carpy@mail.ru> qp 25741 uid 1005
May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery 169:
msg 245715 to local greg@romualt.dhs.org
May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 remote
0/20
May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: success:
did_0+0+1/
May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 remote
0/20
May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715


_______________________________________________
Speakup mailing list
Speakup@braille.uwo.ca
http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: Hoax virus was Re: more worms

[Rich Caloggero]

A colleague got an e-mail last week which described the Klez virus and then
tried to convince the reader to open the attached file, claiming it was a
program which could help in warding of the virus. That's pretty skummy!

                    Rich

----- Original Message -----
From: "Adam Myrow" <myrow@eskimo.com>
To: <speakup@braille.uwo.ca>
Sent: 13 May, 2002 7:02 PM
Subject: Re: Hoax virus was Re: more worms


I got a warning about that hoax at work.  That's really dirty!  With all
these real viruses doing real damage, somebody takes advantage of people's
ignorance and has them deleting part of their system.  With all these
viruses going around, I sometimes wonder if the antivirus software vendors
perhaps write viruses in their spare time so they can sell more software?
Maybe I'm being paranoid, but there are just too many viruses out there to
be believed!  Between that and spam, I'm just about to lose my mind!

Re: Hoax virus was Re: more worms

[Toby Fisher]

On Mon, 13 May 2002, Rich Caloggero wrote:

> A colleague got an e-mail last week which described the Klez virus and then
> tried to convince the reader to open the attached file, claiming it was a
> program which could help in warding of the virus. That's pretty skummy!

This te chnique is also not new unfortunately.

Cheers.

-- 
Toby Fisher	Email: toby@g0ucu.freeserve.co.uk
Tel.: +44(0)1480 417272	Mobile: +44(0)7974 363239
ICQ: #61744808
   Please avoid sending me Word or PowerPoint attachments.
   See http://www.fsf.org/philosophy/no-word-attachments.html

Re: more worms

[Shaun Oliver]

ok people, don't even try to guess where the message came from.
The reason I say this is because people are using a technique called ip
spoofing.
it's accomplished by somebody using the standard proxy ports either 1080
23 or 80 or 8080
people make a nucence of themselves by doing this and because of this
technique it's harder to track where things such as DoS "denyal of
service" attacks and spam originate from.
and as some of you well know, it doesn't take much to change email header
information.
so, let's not second guess here.
Shaun.

Re: Hoax virus was Re: more worms

[Shaun Oliver]

no you're not being paranoied, I've either heard or read somewhere that
this is the case.
believe it or not old viruses are being reinvented. Why reinvent the
wheel?
oh well, to hell with them I say.

Re: Hoax virus was Re: more worms

[TALMAGE]

Yes, that was the sulfnkb.exe file in the Windows\command directory they
were calling for you to delete last time.  That 1 has been going around for
4 or 5 years and seems to have a 6 month appearance cycle.
You can usually tell the warnings are bogus because they include a lot of
hype, 'The most dangerous ever', 'extremely destructive', and very little
substance, 'Microsoft warns', 'IBM warns', etc., but no web site address
where to get more info.  In the few cases where they include a web site, it
turns out to be a bad address.
At least this one shows a bit of imagination by changing the files you are
supposed to get rid of.
I also like the one regarding the game that is someone's first attempt and
they think I'll like it.  If it is their first attempt, it is doubtfull
I'll like it, and since most of the time I don't have a clue who they are,
what makes anyone think I'll like it 

Dave

At 02:27 AM 5/14/02 +0100, you wrote:
>You could be right, I wouldn't like to comment.  However it's not the
>first time this sort of thing has gone round.  This one is just something
>to do with java display, or it might be a java applette or something like
>that, but the first  one of its type, sulf something, was to do with being
>able to save files with names longer than 8.3.
>
>Cheers.
>
>-- 
>Toby Fisher	Email: toby@g0ucu.freeserve.co.uk
>Tel.: +44(0)1480 417272	Mobile: +44(0)7974 363239
>ICQ: #61744808
>   Please avoid sending me Word or PowerPoint attachments.
>   See http://www.fsf.org/philosophy/no-word-attachments.html
>
>
>
>_______________________________________________
>Speakup mailing list
>Speakup@braille.uwo.ca
>http://speech.braille.uwo.ca/mailman/listinfo/speakup
>

Re: Hoax virus was Re: more worms

[Alex Snow]

It was some weird address that sent me that game.  The file was about 86k so
even if it was a game it probably sucked so much that I wouldn't play it
anyway.
----- Original Message -----
From: <TALMAGE@somtel.com>
To: <speakup@braille.uwo.ca>
Sent: Tuesday, May 14, 2002 9:29 AM
Subject: Re: Hoax virus was Re: more worms


> Yes, that was the sulfnkb.exe file in the Windows\command directory they
> were calling for you to delete last time.  That 1 has been going around
for
> 4 or 5 years and seems to have a 6 month appearance cycle.
> You can usually tell the warnings are bogus because they include a lot of
> hype, 'The most dangerous ever', 'extremely destructive', and very little
> substance, 'Microsoft warns', 'IBM warns', etc., but no web site address
> where to get more info.  In the few cases where they include a web site,
it
> turns out to be a bad address.
> At least this one shows a bit of imagination by changing the files you are
> supposed to get rid of.
> I also like the one regarding the game that is someone's first attempt and
> they think I'll like it.  If it is their first attempt, it is doubtfull
> I'll like it, and since most of the time I don't have a clue who they are,
> what makes anyone think I'll like it
>
> Dave
>
> At 02:27 AM 5/14/02 +0100, you wrote:
> >You could be right, I wouldn't like to comment.  However it's not the
> >first time this sort of thing has gone round.  This one is just something
> >to do with java display, or it might be a java applette or something like
> >that, but the first  one of its type, sulf something, was to do with
being
> >able to save files with names longer than 8.3.
> >
> >Cheers.
> >
> >--
> >Toby Fisher Email: toby@g0ucu.freeserve.co.uk
> >Tel.: +44(0)1480 417272 Mobile: +44(0)7974 363239
> >ICQ: #61744808
> >   Please avoid sending me Word or PowerPoint attachments.
> >   See http://www.fsf.org/philosophy/no-word-attachments.html
> >
> >
> >
> >_______________________________________________
> >Speakup mailing list
> >Speakup@braille.uwo.ca
> >http://speech.braille.uwo.ca/mailman/listinfo/speakup
> >
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
>

Re: Hoax virus was Re: more worms

[Alex Snow]

Back in the dos days, there was this thing going around that said that if
you typed deltree at the prompt, It was a game.  Of course it wasn't, it
would delete all your files.
The file jdbgmgr.exe is a file that has something to do with jdbc I think.
----- Original Message -----
From: "Toby Fisher" <toby_fisher@bigfoot.com>
To: <speakup@braille.uwo.ca>
Sent: Monday, May 13, 2002 9:27 PM
Subject: Re: Hoax virus was Re: more worms


> On Mon, 13 May 2002, Adam Myrow wrote:
>
> > I got a warning about that hoax at work.  That's really dirty!  With all
> > these real viruses doing real damage, somebody takes advantage of
people's
> > ignorance and has them deleting part of their system.  With all these
> > viruses going around, I sometimes wonder if the antivirus software
vendors
> > perhaps write viruses in their spare time so they can sell more
software?
>
> You could be right, I wouldn't like to comment.  However it's not the
> first time this sort of thing has gone round.  This one is just something
> to do with java display, or it might be a java applette or something like
> that, but the first  one of its type, sulf something, was to do with being
> able to save files with names longer than 8.3.
>
> Cheers.
>
> --
> Toby Fisher Email: toby@g0ucu.freeserve.co.uk
> Tel.: +44(0)1480 417272 Mobile: +44(0)7974 363239
> ICQ: #61744808
>    Please avoid sending me Word or PowerPoint attachments.
>    See http://www.fsf.org/philosophy/no-word-attachments.html
>
>
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
>