E-mail Virus

[Abby Ricart]

Is it just me, or is some one posing as julliard(a)winehq.org and 
dmitry(a)baikal.ru sending e-mail virii into the mailing list? My ISP filtered 
it before I could get it, and it's a Windows virus so I doubt it could do 
very much damage. The virus is described as W32.Beagle.X(a)mm.

Someone is being rather childish. The subject lines were:

"Encrypted Document"
"Hidden Message"
and
"RE: Text Message"

[Dmitry Timoshkov]

"Abby Ricart" <aricart(a)rochester.rr.com> wrote:
> Is it just me, or is some one posing as julliard(a)winehq.org and 
> dmitry(a)baikal.ru sending e-mail virii into the mailing list? My ISP filtered 
> it before I could get it, and it's a Windows virus so I doubt it could do 
> very much damage. The virus is described as W32.Beagle.X(a)mm.

Look for originating ip address not the From: field. Viruses
are known to use fake 'from' addresses from the address book
of an infected Windows machine.

-- 
Dmitry.

[Peter Hartshorn]

On Tue, 4 May 2004 02:56 pm, Dmitry Timoshkov wrote:
> "Abby Ricart" <aricart(a)rochester.rr.com> wrote:
> > Is it just me, or is some one posing as julliard(a)winehq.org and
> > dmitry(a)baikal.ru sending e-mail virii into the mailing list? My ISP
> > filtered it before I could get it, and it's a Windows virus so I doubt it
> > could do very much damage. The virus is described as W32.Beagle.X(a)mm.
>
> Look for originating ip address not the From: field. Viruses
> are known to use fake 'from' addresses from the address book
> of an infected Windows machine.

All the virus messages are coming from fw-hotel.rcmp-fairmont.org 
(209.52.45.59). There are no valid emails on this list which originate from 
this ip address, so is it possible to block messages from this ip address?

[Duane Clark]

Peter Hartshorn wrote:
> All the virus messages are coming from fw-hotel.rcmp-fairmont.org 
> (209.52.45.59). There are no valid emails on this list which originate from 
> this ip address, so is it possible to block messages from this ip address?

I've added a rule to the mailman interface to (hopefully) block them. 
We'll see what happens, I guess.