From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from rwcrmhc51.attbi.com ([204.127.198.38]) by speech.braille.uwo.ca with esmtp (Exim 3.35 #1 (Debian)) id 177Lpa-0008Np-00 for ; Mon, 13 May 2002 15:50:02 -0400 Received: from mycomputer ([24.62.38.156]) by rwcrmhc51.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with SMTP id <20020513194931.IEWH29832.rwcrmhc51.attbi.com@mycomputer> for ; Mon, 13 May 2002 19:49:31 +0000 Message-ID: <003501c1fab7$1bb6ab80$02263e18@mycomputer> From: "Igor Gueths" To: References: <20020512231916.A25834@romualt.dhs.org> Subject: Re: more worms Date: Mon, 13 May 2002 15:48:08 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: speakup-admin@braille.uwo.ca Errors-To: speakup-admin@braille.uwo.ca X-BeenThere: speakup@braille.uwo.ca X-Mailman-Version: 2.0.8 Precedence: bulk Reply-To: speakup@braille.uwo.ca List-Help: List-Post: List-Subscribe: , List-Id: Speakup is a screen review system for Linux. List-Unsubscribe: , List-Archive: Hi Greg. It seems that someone is using a server in Russia, and also = using Rcn ----- Original Message -----=20 From: Gregory Nowak To: Sent: Monday, May 13, 2002 12:19 AM Subject: more worms > Hi all, >=20 > I just wanted to say that the earlier incident where Kerry's e-mail = was faked, and a worm was sent to the list was not the only one. I've = just recieved a private e-mail with a faked address from = mailman-owner@braille.uwo.ca with a similar worm. I'm including the = headers below along with the entry from my qmail messages. > Greg >=20 >=20 >=20 > From carpy@mail.ru Mon May 13 02:37:54 2002 > Return-Path: > Delivered-To: greg@romualt.dhs.org > Received: (qmail 25741 invoked from network); 13 May 2002 02:37:50 = -0000 > Received: from mx9.mail.ru (194.67.57.19) > by softdnserror with SMTP; 13 May 2002 02:37:50 -0000 > Received: from 146-115-123-205.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com = ([146.115.123.205] helo=3DYshdx) > by mx9.mail.ru with smtp (Exim SMTP.9) > id 1775u8-000Erg-00 > for greg@romualt.dhs.org; Mon, 13 May 2002 06:49:40 +0400 > From: mailman-owner > To: greg@romualt.dhs.org > Subject: A special good tool > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary=3DAP7383eS3L5oq9gt0 > Message-Id: > Date: Mon, 13 May 2002 06:49:40 +0400 > Status: RO > Content-Length: 169918 > Lines: 2345 >=20 >=20 >=20 > The following is from my /var/adm/messages. >=20 >=20 > May 12 21:37:54 linserver qmail: 1021257474.823623 new msg 245715 > May 12 21:37:54 linserver qmail: 1021257474.824347 info msg 245715: = bytes 170583 from qp 25741 uid 1005 > May 12 21:37:54 linserver qmail: 1021257474.832134 starting delivery = 169: msg 245715 to local greg@romualt.dhs.org > May 12 21:37:54 linserver qmail: 1021257474.832687 status: local 1/10 = remote 0/20 > May 12 21:37:55 linserver qmail: 1021257475.006857 delivery 169: = success: did_0+0+1/ > May 12 21:37:55 linserver qmail: 1021257475.006965 status: local 0/10 = remote 0/20 > May 12 21:37:55 linserver qmail: 1021257475.007005 end msg 245715 >=20 >=20 > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup