E-mail Virus

[Abby Ricart]

Is it just me, or is some one posing as [e-mail] and 
[e-mail] sending e-mail virii into the mailing list? My ISP filtered 
it before I could get it, and it's a Windows virus so I doubt it could do 
very much damage. The virus is described as W32.Beagle.X@mm.

Someone is being rather childish. The subject lines were:

"Encrypted Document"
"Hidden Message"
and
"RE: Text Message"

[Dmitry Timoshkov]

"Abby Ricart"  wrote:
> Is it just me, or is some one posing as [e-mail] and 
> [e-mail] sending e-mail virii into the mailing list? My ISP filtered 
> it before I could get it, and it's a Windows virus so I doubt it could do 
> very much damage. The virus is described as W32.Beagle.X@mm.

Look for originating ip address not the From: field. Viruses
are known to use fake 'from' addresses from the address book
of an infected Windows machine.

[Peter Hartshorn]

On Tue, 4 May 2004 02:56 pm, Dmitry Timoshkov wrote:
> "Abby Ricart"  wrote:
> > Is it just me, or is some one posing as [e-mail] and
> > [e-mail] sending e-mail virii into the mailing list? My ISP
> > filtered it before I could get it, and it's a Windows virus so I doubt it
> > could do very much damage. The virus is described as W32.Beagle.X@mm.
>
> Look for originating ip address not the From: field. Viruses
> are known to use fake 'from' addresses from the address book
> of an infected Windows machine.

All the virus messages are coming from fw-hotel.rcmp-fairmont.org 
(209.52.45.59). There are no valid emails on this list which originate from 
this ip address, so is it possible to block messages from this ip address?

[Duane Clark]

Peter Hartshorn wrote:
> All the virus messages are coming from fw-hotel.rcmp-fairmont.org 
> (209.52.45.59). There are no valid emails on this list which originate from 
> this ip address, so is it possible to block messages from this ip address?

I've added a rule to the mailman interface to (hopefully) block them. 
We'll see what happens, I guess.