Somebody has a virus...

Sorry about this being somewhat off-topic, but tracking these things down
is keeping me from writing code, so it is on-topic, in a way :-)

So far it appears to be three somebodies on this list have been
infected by viruses, that I have email headers for. The one that is keeping
ME busiest is the probable current owner of ip address 213.84.144.241, which
is a DSL line at xs4all.nl. There is another address 61.95.204.47, which
appears to be owned by a company called mantraonline.com, which is, I
believe, an ISP in India. There is a third address, 203.91.147.165, which is
much harder to track because it isn't  officially registered anywhere, but
seems to route through btnaccess.com. I haven't been able to narrow that
down much, unfortunately.
If any subscribers to the list are using a windows client to read the list,
I STRONGLY recommend running a virus scan on your computer, and running
Windows Update at the first available opportunity. If you don't have a virus
scanner, I would be glad to find you one, I know of at least one that is
available online for free, for example. In a pinch, I'll even help you fix
the problem...

If anybody is curious about the finer points of tracking these things down,
the key points are that all viruses currently running around the internet
lie about where they are coming from in the From: header of the email, and
for some reason they AREN'T trying to lie about where they are coming from
in the Received: headers. Actually, that isn't true, they are putting a fake
domain name, but the IP address (which is put there by the receiving server)
is correct, and they do not seem to be adding any extra Received lines.
Should they start faking Received: lines it will be a little more annoying,
but not much, as it is highly likely that the first line which is obviously
not an ISP mail server is the source of the virus.
If you are receiving email viruses, check the headers for the last line that
says Received: and look for the ip address embedded in that line. That is the
culprit. For example: 
Received: from craigwest.net (unknown [61.95.204.47]) by gabriel.bdkw (Postfix) with ESMTP id 0CFB613A6C for <[email protected]>; Wed,  7 Apr 2004 01:37:08 -0400 (EDT)
contains the ip address 61.95.204.47, which is somebody in India, most
likely.

Received: from register.nl (a213-84-144-241.adsl.xs4all.nl [213.84.144.241]) by gabriel.bdkw (Postfix) with ESMTP id DB3F613A6C; Wed,  7 Apr 2004 03:36:29 -0400 (EDT)
This one, on the other hand, claimed to be coming from register.nl, but was
actually coming from a213-84-144-241.adsl.xs4all.nl. My smtp server was kind
enough to look the actual address up (213.84.144.241) and insert the actual
hostname in the header for me...

-- 
Craig West         Ph: (416) 666-1645	|  It's not a bug,
[email protected]              	|  It's a feature...