Recent SLUG message did NOT have a mail worm in it
Mabry Tyson <[email protected]> Tue, 27 Jan 2004 01:06:17 -0800
| Newsgroups | gmane.lisp.org.slug |
|---|---|
| Message-ID | <[email protected]> |
A message a couple of hours ago with a subject of "hi" with a body of "test" was sent to the SLUG list as though it was from a person on this list. In fact, the message was forged and was actually delivered from a host in Russia. However, since its alleged sender was a person on this list, the mail was relayed to the list. The original message was sent to the mailing list exploder with a mail worm in it, but the worm was removed before it was relayed. We run a virus scanner that filters all incoming mail. I don't suggest you open the message, but if you were to open it, you will see that the worm was deleted before it was relayed to the SLUG list. The original attachment was replaced by a DELETED0.TXT file (unfortunately it is base64 encoded so it is hard to read) which indicates that the original attachment included the "virus" W32.Novarg.A@mm. I expect each of you has heard of this worm by now, but if not, please see http://securityresponse.symantec.com/avcenter/venc/data/[email protected] I have set something up that should prevent mails with the deleted viruses from getting to the list. To be clear: The mail you received that was sent to the SLUG list did *not* have a virus or worm in it.