Thanks for the insight. For some reason the BadTrans virus leaves the return
address intact. In fact I received it twice from the same source. I went to
the reflector archives and I checked to see if the sender was a valid
reflector participant and he was. So I sent him an email asking him if he
could clean his machine. I got a reply - another message with the virus
attached :-). So I was quite certain who the source of the virus was. I made
a request that his name be taken off the reflector. Of course you are
correct about other viruses.
cul
.. sylvan
----------------
Sylvan Katz
VE5ZX & G0TZX
Saskatoon, SK
----- Original Message -----
From: "David Robbins" <k1ttt@berkshire.net>
To: "Sylvan Katz" <jskatz@sk.sympatico.ca>; "Andy Faber"
<andrew.faber@gte.net>; "CONTEST" <CQ-Contest@contesting.com>
Sent: Friday, May 25, 2001 3:48 AM
Subject: Re: [CQ-Contest] V**** warning (List related -- not an urban
legend)
> unfortunately this won't help. most of those worm viruses work on the
address
> list the user has on their machine. i have received several copies of the
> hybris worm that probably originated from list users because they used
'reply
> all' or added me to their address book from a message posted on the list.
in no
> case has a virus made it through a reflector as they strip the
attachments.
> also it is not always easy to figure out just who sent the virus, the
hybris
> worm strips the user mailbox name so all you can find is the originating
server
> which is usually just some isp's address.
>
>
> Sylvan Katz wrote:
> >
> > I encountered this problem on another contesting.com list. The problem
> > arises because someone on the reflector has the BADTRANS virus [ alias
> > IWorm_Badtrans, I-Worm]. For details about this virus see
> > http://www.europe.f-secure.com/v-descs/badtrans.shtml . The way I
handled
> > the problem was to send a message to the list moderator, provide the
email
> > address from which the virus originated and asked if this individual
could
> > be dropped from the reflector until they disinfected their machine.
> > Unfortunately it did not help to send a message to the individual with
the
> > infected computer since all that did was prompt the infected machine to
send
> > me the virus again.
> >
> > .. sylvan
> >
> > ----------------
> > Sylvan Katz
> > VE5ZX & G0TZX
> > Saskatoon, SK
> >
> > --
> > CQ-Contest on WWW: http://lists.contesting.com/_cq-contest/
> > Administrative requests: cq-contest-REQUEST@contesting.com
>
> --
> David Robbins K1TTT
> e-mail: mailto://k1ttt@berkshire.net
> web: http://www.berkshire.net/~robbins/k1ttt.html or http://www.k1ttt.net
> AR-Cluster node: 145.69MHz or telnet://k1ttt.net
--
CQ-Contest on WWW: http://lists.contesting.com/_cq-contest/
Administrative requests: cq-contest-REQUEST@contesting.com
|