Re: Linux and virii

I knew virus's mailed themselves to individuals it finds in the infected 
machines address book (and I've heard some actually go beyond the address
book, and find ALL addresses on the HD), but I was not aware that they
mailed themselves as coming FROM the addresses in the book. This appears 
to be what's happenning here. 

Eljon Curry, Is this what you meant by "spoofing"?

> Message: 1
> Date: Fri, 6 Feb 2004 17:09:21 -0800
> From: Mark Ness <[email protected]>
> To: [email protected]
> Subject: Linux and Virii
> In-Reply-To: <[email protected]>
> User-Agent: Mutt/1.4i
> Precedence: junk
> Reply-To: [email protected]
> List-Help: <mailto:[email protected]?subject=help>
> List-Post: <mailto:[email protected]>
> List-Subscribe: <https://www.redhat.com/mailman/listinfo/redhat-ppp-list>,
> 	<mailto:[email protected]?subject=subscribe>
> List-Id: Setting up dialup networking <redhat-ppp-list.redhat.com>
> List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/redhat-ppp-list>,
> 	<mailto:[email protected]?subject=unsubscribe>
> List-Archive: <https://www.redhat.com/mailman/private/redhat-ppp-list/>
> 
> This may be OT, but I guess it could be concidered in the realm of ppp. 
> 
> I have a stripped down RH9.0 for for internet connection, and a Mandrake 
> 9 connected by LAN. Dial-up ISP with dynamic IP, and realitively short 
> on-line time per connection (by choice, with no dedicated line, can't
> tie up the phone). 
> 
> I've been hit with several infected emails in the last week or so. 
> Recieving these virus' is not the problem, getting "returned" or "refused" 
> mail from people and places I HAVE NOT SENT MAIL TO is the problem. 
> 
> A friend of mine has just finished setting up Squirrel mail on his Linux
> system. He's been hosting my "domain" mail for some time now, and I have 
> had no problems. It's just since I started using his Squirrel that I
> started getting these returned mails. Is it possible that Squirrel mail 
> has some vulnerability to infections? Or has someone just finally gotten 
> around to "stealing" my address (it's one of many addresses, but it is
> my "main" address). 
> 
> FYI I have never put my Windoze on line, and I never check suspect mail 
> (that Linux can't display properly) with Windoze. If it won't display on 
> Linux, I delete them. If I don't know the sender, I usually go ahead and 
> check them out then delete them. 
> 
> Has anybody ever heard of Linux being infected, at least to the extent
> of someons home dir? 
> 
> One more point. Alot of the mail I get is from friends who for some
> reason or another never cut and paste messages, but just forward them
> and forward them etc until the header is actually larger than the file
> itself. 
> 
> -- 
> --------------------------------------------------------------------------
> [email protected]                                             www.noneinc.us
> 
> 

> Message: 2
> From: "Eljon Curry" <[email protected]>
> To: <[email protected]>
> Subject: RE: Linux and Virii
> Date: Sat, 7 Feb 2004 06:39:29 -0500
> In-Reply-To: <[email protected]>
> Importance: Normal
> Precedence: junk
> Reply-To: [email protected]
> List-Help: <mailto:[email protected]?subject=help>
> List-Post: <mailto:[email protected]>
> List-Subscribe: <https://www.redhat.com/mailman/listinfo/redhat-ppp-list>,
> 	<mailto:[email protected]?subject=subscribe>
> List-Id: Setting up dialup networking <redhat-ppp-list.redhat.com>
> List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/redhat-ppp-list>,
> 	<mailto:[email protected]?subject=unsubscribe>
> List-Archive: <https://www.redhat.com/mailman/private/redhat-ppp-list/>
> 
> While i've never used this mail client I do know of the new worm that's
> going around.  It will spoof emails like the ones you are receiving in an
> attemp to get you to open them.  It will read your contacts, spoof them with
> an address from 4 _contact_scans_ago_ as a way of generating email
> addresses.  I'd check out viruslist.com for some information about detection
> and removal.  My firm guess is this is what's going on.  Either you're
> infected and sending to those in your list or you're receiving the spoofed
> mails.  The subject content is usually something about either Failed Daemon
> or Returned in some way.  Follow up if you can.  I'd like to know if i'm way
> off or dead on.  Good luck.
> 
> Eljon Curry
> 
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]]On Behalf Of Mark Ness
> Sent: Friday, February 06, 2004 8:09 PM
> To: [email protected]
> Subject: Linux and Virii
> 
> 
> This may be OT, but I guess it could be concidered in the realm of ppp.
> 
> I have a stripped down RH9.0 for for internet connection, and a Mandrake
> 9 connected by LAN. Dial-up ISP with dynamic IP, and realitively short
> on-line time per connection (by choice, with no dedicated line, can't
> tie up the phone).
> 
> I've been hit with several infected emails in the last week or so.
> Recieving these virus' is not the problem, getting "returned" or "refused"
> mail from people and places I HAVE NOT SENT MAIL TO is the problem.
> 
> A friend of mine has just finished setting up Squirrel mail on his Linux
> system. He's been hosting my "domain" mail for some time now, and I have
> had no problems. It's just since I started using his Squirrel that I
> started getting these returned mails. Is it possible that Squirrel mail
> has some vulnerability to infections? Or has someone just finally gotten
> around to "stealing" my address (it's one of many addresses, but it is
> my "main" address).
> 
> FYI I have never put my Windoze on line, and I never check suspect mail
> (that Linux can't display properly) with Windoze. If it won't display on
> Linux, I delete them. If I don't know the sender, I usually go ahead and
> check them out then delete them.
> 
> Has anybody ever heard of Linux being infected, at least to the extent
> of someons home dir?
> 
> One more point. Alot of the mail I get is from friends who for some
> reason or another never cut and paste messages, but just forward them
> and forward them etc until the header is actually larger than the file
> itself.
> 
> --
> --------------------------------------------------------------------------
> [email protected]                                             www.noneinc.us
> 
> 
> _______________________________________________
> Redhat-ppp-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/redhat-ppp-list
> 
> 
> 
> 
> 


Content-Description: Digest Footer
> _______________________________________________
> Redhat-ppp-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/redhat-ppp-list
> 


-- 
--------------------------------------------------------------------------
[email protected]                                             www.noneinc.us