Re: Birding In NM (was: Virus infection alert !)

2004-04-07 Thread Deborah Harrell
 Ronn!Blankenship [EMAIL PROTECTED] wrote:
 At 07:48 PM 4/4/04, Deborah Harrell wrote:
 
 I haven't been there, but I have canoed in a
 fly-over waterway near Logan, Utah,
 
 Where, exactly, WRT Logan?  I'm thinking of the bird
 sanctuary west of 
 Brigham City on the way to the Thiokol plant 
 Promontory Point.

Um, can I plead inability to describe it exactly?  ';}
I wasn't driving...it was a large, created wetlands
(they'd partially dammed a river), with lots of teal,
ducks, plovers, some cranes, and assorted mergansers,
coots, and songbirds for good measure.

Debbi
It's Really *Not* Genetic Maru  ;) 

__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Symphony (was: Virus infection alert !)

2004-04-07 Thread Deborah Harrell
 Ronn!Blankenship [EMAIL PROTECTED] wrote:
 At 04:15 PM 4/4/04, Deborah Harrell wrote:

 To Our Resident Puck
 
 Them sounds like fightin' words, ma'am . . .

Well, dueling punsters _would_ be a pleasant diversion
for the List...although the humorists here do quite
well without any need for absolute supremacy.

Debbi
How To Parse The Punster IQ Maru

__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Symphony (was: Virus infection alert !)

2004-04-07 Thread Deborah Harrell
 [EMAIL PROTECTED] wrote:

 Load a round of shot and prepair to fire!
 BOOM
 
 WHAT!!!
 
 That wasn't a shell. It was a beehive.
 
 And they're swarming and coming back.
 
 And they look angry and out for revenge.
 
 
 Oh what fuels these mortared bees?

grin
A family near Denver has discovered a massive beehive
in their attic - something like 8x3x2 _feet_.  Really!
(saw it on the news last night - but can't find a pic
on any of the TV websites -- it was fairly impressive;
not something I'd want hanging over my bedroom...)

Debbi
What's The Buzz, Tell Me Whatsa Happin'in Maru

__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Birding In NM (was: Virus infection alert !)

2004-04-06 Thread Travis Edmunds

From: JDG [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Birding In NM (was: Virus infection alert !)
Date: Mon, 05 Apr 2004 22:25:30 -0400
At 11:48 AM 4/5/2004 -0230 Travis Edmunds wrote:
You want birds? Then come to my island.
What island is that?

Newfoundland, Canada.

-Travis

_
Tired of spam? Get advanced junk mail protection with MSN Premium   
http://join.msn.com/?pgmarket=en-capage=byoa/premxAPID=1994DI=1034SU=http://hotmail.com/encaHL=Market_MSNIS_Taglines

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Birding In NM (was: Virus infection alert !)

2004-04-05 Thread Travis Edmunds

From: JDG [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Birding In NM (was: Virus infection alert !)
Date: Sun, 04 Apr 2004 17:19:45 -0400
Bosque de Apache National Wildlife Refuge.

A primary winter home for the nation's population of sandhill cranes.
The scene of so many cranes and other waterbirds in one place is absolutely
stunning - straight out of a Nature or National Geographic program.
And if you chat with the locals, they might direct you to some of the
smaller places where there are fewer crowds.
JDG

You want birds? Then come to my island. I can take my dog for a walk, and 
nearly trip over wild partridge (grouse). A family of bald eagles has a nest 
where I am currently working, which is less than 20 ft from the Atlantic 
ocean. It's pretty neat to see the seagulls and the crows chasing the eagles 
away. Falcons are not uncommon, though you have to be in the right place 
(which is all in an approx 5 km diameter from where I live). Puffins are 
neat, if you take a boat or sea-kayak tour. And birds aside, it nothing 
strange to see a moose running down the street. We have lynx around...and 
ah...my dog Rocky...

-Travis

_
MSN Premium includes powerful parental controls and get 2 months FREE*   
http://join.msn.com/?pgmarket=en-capage=byoa/premxAPID=1994DI=1034SU=http://hotmail.com/encaHL=Market_MSNIS_Taglines

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Symphony (was: Virus infection alert !)

2004-04-05 Thread Julia Thompson


On Sun, 4 Apr 2004, Ronn!Blankenship wrote:

 At 04:15 PM 4/4/04, Deborah Harrell wrote:
 
 
 To Our Resident Puck
 
 
 
 Them sounds like fightin' words, ma'am . . .

Stick with me and I'll show you some more.  :)

Julia

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-04 Thread Richard Baker
Erik said:

 Try getting a clue.

What would you suggest as the first few steps towards gettting a clue?
What are the most important proto-clue concepts? (In general, I mean,
not specifically in this case.)

Rich
GCU Serious Question
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-04 Thread Erik Reuter
On Sun, Apr 04, 2004 at 03:17:34PM +0100, Richard Baker wrote:

 What would you suggest as the first few steps towards gettting a clue?
 What are the most important proto-clue concepts? (In general, I mean,
 not specifically in this case.)

Pay attention. Read carefully. Think about connections and
possibilities.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-04 Thread Richard Baker
Erik said:

 Pay attention. Read carefully. Think about connections and
 possibilities.

Those are good. I'd add something like: Assume you could be wrong;
think about the ways you're most likely to be wrong; find out if you
are wrong.

Any others? How about some good book recommendations on getting a clue?

Rich
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-04 Thread Erik Reuter
On Sun, Apr 04, 2004 at 04:04:45PM +0100, Richard Baker wrote:

 Any others?

Ask yourself questions and try to answer them yourself first.

 How about some good book recommendations on getting a clue?

Sorry, not a clue. But if I wanted such a book, I would start by surfing
to various book-related websites and searching for what I wanted.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-04 Thread Robert Seeberger

- Original Message - 
From: Richard Baker [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Sent: Sunday, April 04, 2004 10:04 AM
Subject: Re: Virus infection alert !


 Erik said:

  Pay attention. Read carefully. Think about connections and
  possibilities.

 Those are good. I'd add something like: Assume you could be wrong;
 think about the ways you're most likely to be wrong; find out if you
 are wrong.

 Any others? How about some good book recommendations on getting a
clue?


I dunno Rich.
It sounds to me like Stick your head up your ass and enjoy the pure
solipsist experience.

But your suggestions are good ones.G


xponent
Slake-Moth Maru
rob


___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-04 Thread Ronn!Blankenship
At 10:15 AM 4/4/04, Erik Reuter wrote:
On Sun, Apr 04, 2004 at 04:04:45PM +0100, Richard Baker wrote:

 Any others?

Ask yourself questions and try to answer them yourself first.


Frex, is Erik just naturally a rude jerk or does he have to work at it?



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Birding In NM (was: Virus infection alert !)

2004-04-04 Thread JDG
Bosque de Apache National Wildlife Refuge.

A primary winter home for the nation's population of sandhill cranes.
The scene of so many cranes and other waterbirds in one place is absolutely
stunning - straight out of a Nature or National Geographic program.   

And if you chat with the locals, they might direct you to some of the
smaller places where there are fewer crowds.

JDG


___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Birding In NM (was: Virus infection alert !)

2004-04-04 Thread Deborah Harrell
 JDG [EMAIL PROTECTED] wrote:

 Bosque de Apache National Wildlife Refuge.
 
 A primary winter home for the nation's population of
 sandhill cranes.
 The scene of so many cranes and other waterbirds in
 one place is absolutely
 stunning - straight out of a Nature or National
 Geographic program.   

I haven't been there, but I have canoed in a fly-over
waterway near Logan, Utah, with hundreds of birds in
the area.  So cool...and isn't the sound those cranes
make fascinating?  Friday, riding by a pond, I saw a
pair of great blue herons - my first of the season. 
:)

Debbi
The Blackbirds Will Arrive Soon, The Robins Have Been
Hear For Weeks Maru

__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Birding In NM (was: Virus infection alert !)

2004-04-04 Thread Ronn!Blankenship
At 07:48 PM 4/4/04, Deborah Harrell wrote:

I haven't been there, but I have canoed in a fly-over
waterway near Logan, Utah,


Where, exactly, WRT Logan?  I'm thinking of the bird sanctuary west of 
Brigham City on the way to the Thiokol plant  Promontory Point.



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Birding In NM (was: Virus infection alert !)

2004-04-04 Thread Julia Thompson


On Sun, 4 Apr 2004, Deborah Harrell wrote:

  Deborah Harrell [EMAIL PROTECTED] wrote:
 
 snip  
  Debbi
  The Blackbirds Will Arrive Soon, The Robins Have
  Been Hear For Weeks Maru

 Now if that'd been intentional, it might be semi-cute,
 but it was merely a mistake...So add a d at the end,
 or change it to Here, as you please.
 
 Can't Even Blame It On A Cold, But -Hey!- What About
 My Allergies? Maru
 achooo!

Blame anything you want on your allergies, I'll be sympathetic.

Julia

Blame It On The Live Oak Maru

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Erik Reuter
On Fri, Apr 02, 2004 at 08:51:52PM -0800, Mike Lee wrote:

 It also does a limited dictionary attack, with a list of several dozen
 common names, sending a message to each of these names on each domain
 in its list. So it doesn't just send to email addresses it got from
 you, it also tries to guess email address names for all the domains it
 found anywhere on your computer. This is very rude, and means that the
 big domains are having to send tons of non-delivery reports for all
 the bogus email coming at them.  And if you're the poor From guy, then
 you start getting all those NDRs delivered to your mailbox too. Along
 with all the bitch mail from antivirus programs telling you that you
 sent them a virus. (This is why these programs should quit notifying
 senders of viruses--forged From is getting to be so common that they
 just end up panicking or annoying someone innocent.)

Actually, there is a better solution than that: SPF

 http://spf.pobox.com/

It could potentially solve all the spam from legitimate computers that
you mention when you get Joe Jobb'ed. It would also break MyDoom, or
force it to use only the From: of the computer it infected.

SPF won't solve all spam and virus problems, but it will help. Everyone
should start using it or encourage their ISP to use it (hopefully all
the big ISP's will turn it on by the end of 2004).


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Alberto Monteiro
The Fool accused me:

 He's Saying something about GMT -02:00.

That's me, when in DST :-P

Alberto Monteiro GMT-03:00

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Alberto Monteiro
The Fool retreated:

 Anyone have directions?

 Should be:

 He's Saying something about GMT +02:00.

Too late. Expect a law suit soon. Hmmm... Where do you live
so that I can a host of lawyers to harass you? Do you have
a spare 1 million dollars that I can extract from you?

Alberto Monteiro

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Alberto Monteiro
Ronn Blankenship wrote:

 FWIW, I've had my address spoofed for a virus attack.  I didn't figure it
 was anything personal. 

It's not personal. I said it about a year ago [?], and I will repeat:

  The Organized Crime is trying to take over the Internet

All those viruses are just to turn _all_ computers into spamming
zombies. They want to use _your_ computer to send their spams.

Alberto Monteiro

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Ronn!Blankenship
At 09:21 PM 4/2/04, Erik Reuter wrote:
On Fri, Apr 02, 2004 at 09:05:40PM -0600, Ronn!Blankenship wrote:

 And you are just deliberately rude.  Try becoming civilized.
Try getting a clue.


Here's a clue:  It is extremely rude to make unfounded allegations about a 
person who is not present in front of his wife who is present.  You owe S 
an apology.



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


SPF, was Re: Virus infection alert !

2004-04-03 Thread Ronn!Blankenship
At 05:55 AM 4/3/04, Erik Reuter wrote:
On Fri, Apr 02, 2004 at 08:51:52PM -0800, Mike Lee wrote:

 It also does a limited dictionary attack, with a list of several dozen
 common names, sending a message to each of these names on each domain
 in its list. So it doesn't just send to email addresses it got from
 you, it also tries to guess email address names for all the domains it
 found anywhere on your computer. This is very rude, and means that the
 big domains are having to send tons of non-delivery reports for all
 the bogus email coming at them.  And if you're the poor From guy, then
 you start getting all those NDRs delivered to your mailbox too. Along
 with all the bitch mail from antivirus programs telling you that you
 sent them a virus. (This is why these programs should quit notifying
 senders of viruses--forged From is getting to be so common that they
 just end up panicking or annoying someone innocent.)
Actually, there is a better solution than that: SPF

 http://spf.pobox.com/

It could potentially solve all the spam from legitimate computers that
you mention when you get Joe Jobb'ed. It would also break MyDoom, or
force it to use only the From: of the computer it infected.
SPF won't solve all spam and virus problems, but it will help. Everyone
should start using it or encourage their ISP to use it (hopefully all
the big ISP's will turn it on by the end of 2004).


Does it require senders to be on a whitelist before sending you any mail, 
as some of the other proposed solutions for spam do, or can people receive 
messages from new senders (frex, new customers attempting to place an 
initial order) without any additional hassle on their part (which, in the 
aforementioned example, is likely to cause many prospective customers to 
look for a competitor whose on-line ordering process is simpler)?



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Erik Reuter
On Sat, Apr 03, 2004 at 01:27:45PM -0600, Ronn!Blankenship wrote:

 Here's a clue:  It is extremely rude to make unfounded allegations
 about a person who is not present in front of his wife who is present.
 You owe S an apology.

Last time: Pay attention! Get a clue! I won't be replying to your
nonsense anymore.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread Ronn!Blankenship
At 01:46 PM 4/3/04, Erik Reuter wrote:
On Sat, Apr 03, 2004 at 01:27:45PM -0600, Ronn!Blankenship wrote:

 Here's a clue:  It is extremely rude to make unfounded allegations
 about a person who is not present in front of his wife who is present.
 You owe S an apology.
Last time: Pay attention! Get a clue! I won't be replying to your
nonsense anymore.


I personally don't care if you respond to anything I post or not.  And it 
doesn't matter if you happen to think that JD is indeed a past member of 
this list.  You still owe that past list member's wife an apology for 
making your assertions openly in front of the whole list and her.  If you 
suspected that JD :== J, or even if you have hard evidence to that 
fact, you should have informed the list owners privately rather than 
bringing it up on the list.



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread John Doe
From: The Fool [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Virus infection alert !
Date: Fri, 2 Apr 2004 18:11:27 -0600
 He's Saying something about GMT +02:00.
That would certainly be consistent. GMT +02:00 includes part of Eastern 
Europe, source of a considerable amount of spam and viruses.

JD

_
Talk with your online friends with MSN Messenger http://messenger.msn.nl/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-03 Thread John Doe
From: Ronn!Blankenship [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Virus infection alert !
Date: Fri, 02 Apr 2004 19:31:53 -0600
YMMV, of course.  But let's not accuse anybody without proof.  Particularly 
when doing so is likely to hurt someone else on the list.
Especially when the suspect has been banned from this list and thus isn't 
able to defend himself. Y'know, fair trial and all that.

JD

_
MSN Search, for accurate results! http://search.msn.nl
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Virus infection alert !

2004-04-02 Thread Sonja van Baardwijk-Holten
Hi,

This message is to inform you that Nick's Brin-L service has just dumped 
an infected message send by Deborah's machine,  on the brin-l list.  
Just to warn the list. And to Nick and Deborah I'd want to suggest that 
they upgrade their virus protection a notch or two. :o)

Infected message was send by
[EMAIL PROTECTED]
with the subject of Re: Excel file
and contained the virus: [EMAIL PROTECTED]
Have fun,

Sonja :o0

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Ronn!Blankenship
At 09:38 AM 4/2/04, Sonja van Baardwijk-Holten wrote:
Hi,

This message is to inform you that Nick's Brin-L service has just dumped 
an infected message send by Deborah's machine,  on the brin-l list.
Just to warn the list. And to Nick and Deborah I'd want to suggest that 
they upgrade their virus protection a notch or two. :o)

Infected message was send by
[EMAIL PROTECTED]
with the subject of Re: Excel file
and contained the virus: [EMAIL PROTECTED]
Have fun,

Sonja :o0


FWIW, I never received the original message, so I suppose it was filtered 
out somewhere before it got here.

(No, thanks . . . no one needs to send me a copy . . . ;-)  )



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Sonja van Baardwijk-Holten wrote:

Hi,

This message is to inform you that Nick's Brin-L service has just dumped 
an infected message send by Deborah's machine,  on the brin-l list.  
Just to warn the list. And to Nick and Deborah I'd want to suggest that 
they upgrade their virus protection a notch or two. :o)

Infected message was send by
[EMAIL PROTECTED]
with the subject of Re: Excel file
and contained the virus: [EMAIL PROTECTED]
The server strips off attachments, so it didn't really come from the 
list, unless something is terribly wrong.

I suspect it is the usual virus forging the return address that makes it 
appear to have come from the list.

Nick

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
Huh? Did you look at the headers? It would be a hell of a good forgery
if your contention is true. Besides, how did they get the Brin-L
subscription list? Is your email list server infected? Or did J do it?

On Fri, Apr 02, 2004 at 10:10:29AM -0800, Nick Arnett wrote:
 Sonja van Baardwijk-Holten wrote:
 
 Hi,
 
 This message is to inform you that Nick's Brin-L service has just dumped 
 an infected message send by Deborah's machine,  on the brin-l list.  
 Just to warn the list. And to Nick and Deborah I'd want to suggest that 
 they upgrade their virus protection a notch or two. :o)
 
 Infected message was send by
 [EMAIL PROTECTED]
 with the subject of Re: Excel file
 and contained the virus: [EMAIL PROTECTED]
 
 The server strips off attachments, so it didn't really come from the 
 list, unless something is terribly wrong.
 
 I suspect it is the usual virus forging the return address that makes it 
 appear to have come from the list.
 
 Nick
 
 
 -- 
 Nick Arnett
 Director, Business Intelligence Services
 LiveWorld Inc.
 Phone/fax: (408) 551-0427
 [EMAIL PROTECTED]
 
 ___
 http://www.mccmedia.com/mailman/listinfo/brin-l

-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Erik Reuter wrote:
Huh? Did you look at the headers? It would be a hell of a good forgery
if your contention is true. Besides, how did they get the Brin-L
subscription list? Is your email list server infected? Or did J do it?
Good forgery?  All it has to do is forge a return address of somebody 
on the list and the message will get through.  (Not that I really want 
everyone to know that.)

More to the point, it wasn't sent as an attachment (don't know how it 
got into the body), so it shouldn't infect anybody.

It's the MyDoom virus or variant -- I recognize the encoding characters. 
 It claims to have originated at btopenworld.com -- I just grepped 
the entire archive and that's the only message with that string in it.

Nick

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


RE: Virus infection alert !

2004-04-02 Thread Horn, John
 From: Erik Reuter [mailto:[EMAIL PROTECTED]
 
 Huh? Did you look at the headers? It would be a hell of a good
forgery
 if your contention is true. Besides, how did they get the Brin-L
 subscription list? Is your email list server infected? Or did J do
it?

Oh please.  Why would he include his wife?

 - jmh
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Sonja van Baardwijk-Holten
Erik Reuter wrote:

Huh? Did you look at the headers? It would be a hell of a good forgery
if your contention is true. Besides, how did they get the Brin-L
subscription list? Is your email list server infected? Or did J do it?
 

Excuse me!?

Sonja
GCU: Stop the unfounded harrasments. I've had more then enough of it.
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Sonja van Baardwijk-Holten
Nick Arnett wrote:

Erik Reuter wrote:

Huh? Did you look at the headers? It would be a hell of a good forgery
if your contention is true. Besides, how did they get the Brin-L
subscription list? Is your email list server infected? Or did J do it?


Good forgery?  All it has to do is forge a return address of 
somebody on the list and the message will get through.  (Not that I 
really want everyone to know that.)

More to the point, it wasn't sent as an attachment (don't know how it 
got into the body), so it shouldn't infect anybody.

It's the MyDoom virus or variant -- I recognize the encoding 
characters.  It claims to have originated at btopenworld.com -- I 
just grepped the entire archive and that's the only message with that 
string in it.
According to Norton the message had an attachment, which was deleted on 
reception of the e-mail (and backed up into the machines quarentine 
zone) to fix the bugged message. I won't dig up the specifics though. 
It's not worth the effort.

Sonja

GCU: Couldn't care less even if I tried

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Deborah Harrell
 Sonja van Baardwijk-Holten wrote:

 This message is to inform you that Nick's Brin-L
 service has just dumped 
 an infected message send by Deborah's machine,  on
 the brin-l list.  
 Just to warn the list. And to Nick and Deborah I'd
 want to suggest that 
 they upgrade their virus protection a notch or two.
 :o)
 
 Infected message was send by
 [EMAIL PROTECTED]
 with the subject of Re: Excel file
 and contained the virus: [EMAIL PROTECTED]

I turned my computer on today approx. 50 minutes ago,
so I don't see how my machine could be have sent the
message (it appears to have started early this AM), so
I checked with the office computer guy.  He looked and
said our firewall hadn't been breached, but mentioned
something about spoofing WRT the appearance of 'me'
having sent this.  FWIW, the same message/vrus wound
up in my yahoo bulk mail, as well as another one
'letter,' _also_ from 'my' yahoo address.

I don't log onto my Yahoo account except from the
office and rarely the public library (not in the past
couple of months), and my actual office email address
has also apparently not be forged/used, nor my Hotmail
account.  I'm not trying to be defensive*, but I do
make an effort to avoid computer virus infection, and
have never opened any unexpected/verified attachments
(according to our tech, even if I did attempt to open
an 'infected' attachment, the system would shut me out
or delete the virus before I could open it).

* But I _am_ really angry about this.  It's like
somebody making nasty prank calls and somehow having
the trace forged back to you.

I don't know about the List address book, but anyone
can access our archives (a couple of us have in fact
gotten emails from people not on the List at all, but
who in googling for something found our posts on
particular subjects).

Debbi
who now feels like she needs a virtual bath:(

__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Sonja van Baardwijk-Holten
How nice to know that you are safe. I'm terribly sorry I mentioned you 
or the list in connection with any of this and I'm very sorry to have 
troubled you or the list with my concerns. It won't happen again.

Sonja
GCU: ...
Deborah Harrell wrote:

Sonja van Baardwijk-Holten wrote:
   

snipped all

 

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Deborah Harrell
 Sonja van Baardwijk-Holten wrote:

 How nice to know that you are safe. I'm terribly
 sorry I mentioned you 
 or the list in connection with any of this and I'm
 very sorry to have 
 troubled you or the list with my concerns. 

wry *You* didn't trouble me...but the
tapeworm-infested mangy cur who unleashed this virus
did! snarl

I realize that I was not a target in particular -
how many thousands have had the same thing happen to
them? (our computer tech said that this 'spoofing' has
been going on for quite a while, so I guess it's only
a matter of time before you or someone you know is
hit) - but that's how it feels.

Kinda ties into Keith's 'xenophobic meme' theme,
doesn't it? [By the by, that was a nicely put
take-down, K. wicked smile] 

Debbi
I've Had Some Chocolate, So I'm Feeling More Mellow
Now Maru   :)
(At Least I'm Not Stomping About Accosting Our Nice
Tech-Support Guy Anymore Maru)

__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 10:44:25AM -0800, Nick Arnett wrote:

 Good forgery?  All it has to do is forge a return address of
 somebody on the list and the message will get through.  (Not that I
 really want everyone to know that.)

But you just said it didn't come through the list! If it didn't come
through the list, it was a damn good forgery.

 More to the point, it wasn't sent as an attachment (don't know how it 
 got into the body), so it shouldn't infect anybody.

It had the standard attachment labels when I received it. It was
specified to be an .xls (Excel) file.



-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 09:13:08PM +0200, Sonja van Baardwijk-Holten wrote:
 Excuse me!?

You're excused. But just this once. Next time you'll need a note from
your mother.

 GCU: Stop the unfounded harrasments.

Or, they're found all right.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Ronn!Blankenship
At 12:22 PM 4/2/04, Erik Reuter wrote:
Huh? Did you look at the headers? It would be a hell of a good forgery
if your contention is true. Besides, how did they get the Brin-L
subscription list? Is your email list server infected? Or did J do it?


IMO that suggestion was uncalled for.



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 03:19:34PM -0600, Ronn!Blankenship wrote:

 IMO that suggestion was uncalled for.

Please try to pay better attention, people...


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread John Doe
From: Erik Reuter [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Virus infection alert !
Date: Fri, 2 Apr 2004 13:22:20 -0500
Huh? Did you look at the headers? It would be a hell of a good forgery
if your contention is true. Besides, how did they get the Brin-L
subscription list? Is your email list server infected? Or did J do it?
Pardon my newbie ignorance, but... J ?

BTW, this list's messages are in a public archive, so anyone could have 
harvested the e-mail addresses from Brin-L subscribers.

JD

_
Hotmail en Messenger on the move 
http://www.msn.nl/communicatie/smsdiensten/hotmailsmsv2/

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread John Doe
From: Erik Reuter [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Virus infection alert !
Date: Fri, 2 Apr 2004 16:01:52 -0500
On Fri, Apr 02, 2004 at 10:44:25AM -0800, Nick Arnett wrote:

 Good forgery?  All it has to do is forge a return address of
 somebody on the list and the message will get through.  (Not that I
 really want everyone to know that.)
But you just said it didn't come through the list! If it didn't come
through the list, it was a damn good forgery.
No, Nick said it didn't come *from* the list. The infected message was sent 
to [EMAIL PROTECTED], so it did come *through* the list, just not from 
anyone *on* the list (at least, I hope it didn't).

JD

_
Play online games with your friends with MSN Messenger 
http://messenger.msn.nl/

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 10:29:49PM +0200, John Doe wrote:

 Pardon my newbie ignorance, but... J ?

Cute, but not nearly convincing enough.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 11:21:47PM +0200, John Doe wrote:

 No, Nick said it didn't come *from* the list. The infected message was
 sent to [EMAIL PROTECTED], so it did come *through* the list, just
 not from anyone *on* the list (at least, I hope it didn't).

Please try to pay better attention, folks.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


RE: Virus infection alert !

2004-04-02 Thread Horn, John
 From: Erik Reuter [mailto:[EMAIL PROTECTED]
 
  IMO that suggestion was uncalled for.
 
 Please try to pay better attention, people...

Better attention to what?  I must not have been paying attention...

 - jmh
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 04:54:41PM -0600, Horn, John wrote:

 Better attention to what?  I must not have been paying attention...

The flow and logic of the discussion. Several people haven't been
following.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Kevin Tarr
At 06:00 PM 4/2/2004, you wrote:

On Fri, Apr 02, 2004 at 04:54:41PM -0600, Horn, John wrote:

 Better attention to what?  I must not have been paying attention...

The flow and logic of the discussion. Several people haven't been
following.
--
Erik Reuter
Damn you are right, as usual. But I wouldn't have noticed without you 
mentioning it.

Kevin
Good job Erik
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Alberto Monteiro
Sonja van Baardwijk-Holten wrote:

 And to Nick and Deborah I'd want to suggest that
 they upgrade their virus protection a notch or two. :o)

I think the real problem is that people trust too much
anti-viruses. Anti-viruses are _useless_: they can
only filter _old_ viruses. The only protection against
new viruses is either using a decent O.S. or 
(deleting every html message and every attachment)

Alberto Monteiro

___
http://www.mccmedia.com/mailman/listinfo/brin-l


RE: Virus infection alert !

2004-04-02 Thread Julia Thompson


On Fri, 2 Apr 2004, Horn, John wrote:

  From: Erik Reuter [mailto:[EMAIL PROTECTED]
  
   IMO that suggestion was uncalled for.
  
  Please try to pay better attention, people...
 
 Better attention to what?  I must not have been paying attention...

I thought I was paying attention, but I think I'm lost.

Anyone have directions?

Julia

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Sonja van Baardwijk-Holten wrote:

According to Norton the message had an attachment, which was deleted on 
reception of the e-mail (and backed up into the machines quarentine 
zone) to fix the bugged message. I won't dig up the specifics though. 
It's not worth the effort.
Norton does string matching on the whole document, without trying to 
figure out what's an attachment or not.  It really doesn't know.  So it 
did what it's supposed to do, though it's a false positive.

Nick

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Erik Reuter wrote:

On Fri, Apr 02, 2004 at 10:44:25AM -0800, Nick Arnett wrote:


Good forgery?  All it has to do is forge a return address of
somebody on the list and the message will get through.  (Not that I
really want everyone to know that.)


But you just said it didn't come through the list! If it didn't come
through the list, it was a damn good forgery.
I didn't realize that *something* came through the list when I wrote 
that.  The something wasn't a virus, however -- it was just the MIME 
representation of a virus, in the body of a plain-text message.

It had the standard attachment labels when I received it. It was
specified to be an .xls (Excel) file.
Perhaps, but unless it is actually formatted as a MIME-encoded message 
(which it wasn't), no e-mail client should treat it as one, making it 
innocuous.

The server doesn't allow multi-part MIME messages to go to the list.

Nick

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Erik Reuter wrote:

On Fri, Apr 02, 2004 at 04:54:41PM -0600, Horn, John wrote:


Better attention to what?  I must not have been paying attention...


The flow and logic of the discussion. Several people haven't been
following.
Some of us don't like to be followers... ;-)

Nick

P.S.  Every mail message that goes through our server is screened for 
viruses using Clam AV. See http://www.clamav.net/

P.P.S.  Here's how the message in question looked to the archiver: 
http://www.mccmedia.com/pipermail/brin-l/Week-of-Mon-20040329/036734.html

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Travis Edmunds

From: Erik Reuter [EMAIL PROTECTED]
Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
To: Killer Bs Discussion [EMAIL PROTECTED]
Subject: Re: Virus infection alert !
Date: Fri, 2 Apr 2004 17:55:28 -0500
On Fri, Apr 02, 2004 at 10:29:49PM +0200, John Doe wrote:

 Pardon my newbie ignorance, but... J ?

Cute, but not nearly convincing enough.

Don't worry JD. Some day you will transcend cute, and move on to cutesy.

-Travis

_
Free yourself from those irritating pop-up ads with MSn Premium. Get 2months 
FREE*  
http://join.msn.com/?pgmarket=en-capage=byoa/premxAPID=1994DI=1034SU=http://hotmail.com/encaHL=Market_MSNIS_Taglines

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread The Fool
 From: Julia Thompson [EMAIL PROTECTED]
 
 On Fri, 2 Apr 2004, Horn, John wrote:
 
   From: Erik Reuter [mailto:[EMAIL PROTECTED]
   
IMO that suggestion was uncalled for.
   
   Please try to pay better attention, people...
  
  Better attention to what?  I must not have been paying attention...
 
 I thought I was paying attention, but I think I'm lost.
 
 Anyone have directions?

He's Saying something about GMT -02:00.
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Deborah Harrell
FWIW, I just got another presumed virus email, 24K,
from [EMAIL PROTECTED], Re: Your software.

Bloody annoying.

Debbi
Off To The Symphony Now Maru


__
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread The Fool
 From: The Fool [EMAIL PROTECTED]

  From: Julia Thompson [EMAIL PROTECTED]
  
  On Fri, 2 Apr 2004, Horn, John wrote:
  
From: Erik Reuter [mailto:[EMAIL PROTECTED]

 IMO that suggestion was uncalled for.

Please try to pay better attention, people...
   
   Better attention to what?  I must not have been paying attention...
  
  I thought I was paying attention, but I think I'm lost.
  
  Anyone have directions?

Should be:
 
 He's Saying something about GMT +02:00.

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 05:39:42PM -0600, Julia Thompson wrote:
 I thought I was paying attention, but I think I'm lost.
 
 Anyone have directions?

For the record, what I was really suggesting was NOT that John Doe
forged the email with the MIME virus representation to make it look like
it passed through the listmailer when it fact he actually mailed it
directly to everyone on the list. No, that is clearly beyond John Doe's
abilities at forgery. That part was a joke. That message clearly DID go
through the listmailer, and I was just kidding with Nick, although I
was curious about it. Nick suggested that the reason it got through the
virus filters was because it was MIME encoded.

Also, the email apparently DID forge the From: address, otherwise brin-l
would not have sent it out. I guess the archive software shouldn't give
the email addresses (even with @ spelled out) because then people can
grab one, forge an email, and get the entire list to receive the spam or
virus.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Medievalbk
In a message dated 4/2/2004 4:41:05 PM US Mountain Standard Time, 
[EMAIL PROTECTED] writes:

 Better attention to what?  I must not have been paying attention...
 
 I thought I was paying attention, but I think I'm lost.
 
 Anyone have directions?
 
   Julia
 

Don't forget the left tern at Albequerque.


Vilyehm
-
(Spellcheck. Wow, did I actually get it right?)
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Medievalbk
In a message dated 4/2/2004 5:11:04 PM US Mountain Standard Time, 
[EMAIL PROTECTED] writes:

 Debbi
 Off To The Symphony Now Maru
 

I want to know what was playing.

But if it aint Baroque, don't fax it.

Vilyehm
-
Falls asleep to most Mahler.
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Robert Seeberger

- Original Message - 
From: John Doe [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, April 02, 2004 2:29 PM
Subject: Re: Virus infection alert !


 From: Erik Reuter [EMAIL PROTECTED]
 Reply-To: Killer Bs Discussion [EMAIL PROTECTED]
 To: Killer Bs Discussion [EMAIL PROTECTED]
 Subject: Re: Virus infection alert !
 Date: Fri, 2 Apr 2004 13:22:20 -0500
 
 Huh? Did you look at the headers? It would be a hell of a good
forgery
 if your contention is true. Besides, how did they get the Brin-L
 subscription list? Is your email list server infected? Or did J do
it?

 Pardon my newbie ignorance, but... J ?

 BTW, this list's messages are in a public archive, so anyone could
have
 harvested the e-mail addresses from Brin-L subscribers.


I've been suggesting just that for a few months now.
I've been getting viruses from names suspiciously like some of our
listmembers and I know I'm not the only one this has happened to.

The viral messages seem to come in flurries over a week or two and
then die off, only to start up again a month or two later.
It hasn't been much of a hassle. My anti-virus is set to auto-update
daily. And Mailwasher  (now working quite well again) has also been
helpful in keeping my inbox clean.

I'm wondering if there is a way to strip addresses from the archive.
It might also act to entice archive lurkers to join the list if they
want to comment rather than mail individuals with their comments
offlist.


xponent
Never Got the Mail In Question Maru
rob


___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread William T Goodall
On 3 Apr 2004, at 1:10 am, Deborah Harrell wrote:

FWIW, I just got another presumed virus email, 24K,
from [EMAIL PROTECTED], Re: Your software.
I get a few emails every day from ISPs telling me I sent a virus. 
Forged headers. I don't actually get any viruses (or much spam) because 
my ISP has filters. And they wouldn't work anyway because I don't run 
any Micro$hit  operating systems

--
William T Goodall
Mail : [EMAIL PROTECTED]
Web  : http://www.wtgab.demon.co.uk
Blog : http://radio.weblogs.com/0111221/
Our products just aren't engineered for security. - Brian Valentine, 
senior vice president in charge of Microsoft's Windows development 
team.

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Ronn!Blankenship
At 03:42 PM 4/2/04, Erik Reuter wrote:
On Fri, Apr 02, 2004 at 03:19:34PM -0600, Ronn!Blankenship wrote:

 IMO that suggestion was uncalled for.

Please try to pay better attention, people...


I have been paying attention . . . for at least the past couple of years, 
in fact.  I've noticed that most of us seem to have moved on from that 
less-than-happy series of events.  IMO it is uncalled for to bring it up 
again unless at the very least someone has overwhelming proof that this is 
somehow related to those past events.

FWIW, I've had my address spoofed for a virus attack.  I didn't figure it 
was anything personal.  In fact, a lot of viruses that have come out during 
the past several months include code that randomly picks an address from 
the ones it harvests from people's address books and spoofs it as the 
From: address when it sends infected messages to the other addresses it 
harvested.  That's what I figured had happened to me when someone informed 
me that they had received an infected file supposedly from me, and if I 
were to guess, that's what I'd guess happened here.

YMMV, of course.  But let's not accuse anybody without proof.  Particularly 
when doing so is likely to hurt someone else on the list.

-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Dave Land
Friends,

Nick suggested that the reason it got through the
virus filters was because it was MIME encoded.
Close.

The message got through the virus filters because it was *not* 
MIME-encoded -- it was a plain text message that just happened to 
contain the the textual representation of a MIME-encoded message.

What's the difference, you ask? The message itself is contained in a 
MIME container that has the type text/plain. The content *would* have 
been interpreted as the violating enclosure if it was not wrapped in a 
text/plain container, but it was.

In short, it looks like the goober who did this /almost/ knows what s/he 
is doing.

Viewing the archived copy 
http://www.mccmedia.com/pipermail/brin-l/Week-of-Mon-20040329/036734.html, 
while perfectly safe, still managed to trigger a virus alert from McAfee 
VirusScan on my machine, reporting an infection by the 
W32/Netsky.d.eml!exe virus -- it is responding to the bit patterns of 
the encoded data, even though it is really just plain text in an HTML page.

Dave

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 07:31:53PM -0600, Ronn!Blankenship wrote:

 I have been paying attention . . . for at least the past couple of
 years,

Oh, then you are just clueless. Sorry, my condolences.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 05:42:23PM -0800, Dave Land wrote:
 The message got through the virus filters because it was *not* 
 MIME-encoded -- it was a plain text message that just happened to 
 contain the the textual representation of a MIME-encoded message.
 
 What's the difference, you ask? The message itself is contained in a 
 MIME container that has the type text/plain. The content *would* have 
 been interpreted as the violating enclosure if it was not wrapped in a 
 text/plain container, but it was.
 
 In short, it looks like the goober who did this /almost/ knows what s/he 
 is doing.

Thanks for the explanation. Heh. Neat hack, I guess.

Did you send it to the maintainers of the virus filters, to see if they
can update their programs to catch this sort of thing?

-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 05:42:23PM -0800, Dave Land wrote:
 The message got through the virus filters because it was *not* 
 MIME-encoded -- it was a plain text message that just happened to 
 contain the the textual representation of a MIME-encoded message.

I was just looking at its header again. I found this:

  Content-Type: text/plain
  X-Priority: 3
  X-MSMail-Priority: Normal
  Message-Id: [EMAIL PROTECTED]
  X-Spam-Prev-Content-Type: multipart/mixed;
  boundary==_NextPart_000_0001_12ED.6321


So it was text/plain, as you said. But it looks like it used to be
multipart/mixed, and something converted it. Any clue what converted it
and added the X-Spam header?


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Erik Reuter wrote:

For the record, what I was really suggesting was NOT that John Doe
forged the email with the MIME virus representation to make it look like
it passed through the listmailer when it fact he actually mailed it
directly to everyone on the list. No, that is clearly beyond John Doe's
abilities at forgery. That part was a joke. That message clearly DID go
through the listmailer, and I was just kidding with Nick, although I
was curious about it. Nick suggested that the reason it got through the
virus filters was because it was MIME encoded.
Just to be clear, it got through the filters because the *message* had a 
 MIME type of plain/text (or none at all, which amounts to the same 
thing).  But that also made it harmless, unless someone goes to the 
trouble of turning the MIME-encoded text back into an executable.

Also, the email apparently DID forge the From: address, otherwise brin-l
would not have sent it out. I guess the archive software shouldn't give
the email addresses (even with @ spelled out) because then people can
grab one, forge an email, and get the entire list to receive the spam or
virus.
But if anyone figures to play games thus, they'd better also figure out 
how to do some sort of IP spoofing...

Spam, yes.  Viruses, no.  At least not in any executable form.  AFAIK.

Nick

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Nick Arnett
Erik Reuter wrote:


So it was text/plain, as you said. But it looks like it used to be
multipart/mixed, and something converted it. Any clue what converted it
and added the X-Spam header?
Nope.  Fairly odd.

Nick

--
Nick Arnett
Director, Business Intelligence Services
LiveWorld Inc.
Phone/fax: (408) 551-0427
[EMAIL PROTECTED]
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Ronn!Blankenship
At 07:51 PM 4/2/04, Erik Reuter wrote:
On Fri, Apr 02, 2004 at 07:31:53PM -0600, Ronn!Blankenship wrote:

 I have been paying attention . . . for at least the past couple of
 years,
Oh, then you are just clueless.


And you are just deliberately rude.  Try becoming civilized.



IAAMOAC Maru



-- Ronn!  :)

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Julia Thompson
Erik Reuter wrote:
 
 On Fri, Apr 02, 2004 at 05:39:42PM -0600, Julia Thompson wrote:
  I thought I was paying attention, but I think I'm lost.
 
  Anyone have directions?
 
 For the record, what I was really suggesting was NOT that John Doe
 forged the email with the MIME virus representation to make it look like
 it passed through the listmailer when it fact he actually mailed it
 directly to everyone on the list. No, that is clearly beyond John Doe's
 abilities at forgery. That part was a joke. That message clearly DID go
 through the listmailer, and I was just kidding with Nick, although I
 was curious about it. Nick suggested that the reason it got through the
 virus filters was because it was MIME encoded.
 
 Also, the email apparently DID forge the From: address, otherwise brin-l
 would not have sent it out. I guess the archive software shouldn't give
 the email addresses (even with @ spelled out) because then people can
 grab one, forge an email, and get the entire list to receive the spam or
 virus.

Aside from your I guess statement, I understood all *that*.  What I
didn't understand was the general apparent cluelessness.

Also, I'm so fried that's about all I *did* understand.  But thank you
to everyone who offered some sort of clarification for me.  :)

Julia

need to get kids to bed, and then help hubby upstairs, then go scarf
down enough calories to make up for the lack I've suffered in the past
48 hours
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Erik Reuter
On Fri, Apr 02, 2004 at 09:05:40PM -0600, Ronn!Blankenship wrote:
 
 And you are just deliberately rude.  Try becoming civilized.

Try getting a clue.


-- 
Erik Reuter   http://www.erikreuter.net/
___
http://www.mccmedia.com/mailman/listinfo/brin-l


RE: Virus infection alert !

2004-04-02 Thread Mike Lee
MyDoom, which is pretty popular right now, tries to read whatever address
books it can find on the victim's computer to harvest email addresses. It
also crawls through a lot of different files--everything with .txt, .htm and
several other extensions, for anything that looks like an email address.
(One of the file extensions is searchs is .dbx, so if you use Outlook
Express, it will find every passing reference to an email address in any
message you still have.)
 
It then picks a harvested address at random to be the lucky From person, and
starts sending mail to all the others. MyDoom also includes a nifty little
mail server in case it can't use your ISP's mail server. It sends messages
with attachments with different extensions, including .ZIP. It tries to fool
you into opening the attachments by using names like this:
 
whatever.dochundred spaces.exe

So you think it's a .doc or .txt or .zip file, and it's really an executable
program.
 
It also does a limited dictionary attack, with a list of several dozen
common names, sending a message to each of these names on each domain in its
list. So it doesn't just send to email addresses it got from you, it also
tries to guess email address names for all the domains it found anywhere on
your computer. This is very rude, and means that the big domains are having
to send tons of non-delivery reports for all the bogus email coming at them.
And if you're the poor From guy, then you start getting all those NDRs
delivered to your mailbox too. Along with all the bitch mail from antivirus
programs telling you that you sent them a virus. (This is why these programs
should quit notifying senders of viruses--forged From is getting to be so
common that they just end up panicking or annoying someone innocent.)
 
It also copies itself to your Kazaa share directory, so you start offering
it to other unwary Kazaa users as one of several different file names.

As for why it ended up being in the body of a message, who knows (or really
cares)? There are new strains of the same old viruses released every day,
each one more incompetent and buggy than the last. Or some kind of filter
munged it up, or something. It could have gotten corrupted or truncated en
route in such a way that the MIME blob became interpreted as plain text.

Bottom line: if you get a virus via email, it's more likely than not these
days that it didn't come from the From: person. You don't even need to
inform them just to be safe. Someone else who's less educated (lots of
someone else's, most likely) will have already done it.

 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of Erik Reuter
 Sent: Friday, April 02, 2004 6:08 PM
 To: Killer Bs Discussion
 Subject: Re: Virus infection alert !
 
 On Fri, Apr 02, 2004 at 06:03:32PM -0800, Nick Arnett wrote:
 
  But if anyone figures to play games thus, they'd better also figure 
  out how to do some sort of IP spoofing...
 
 Or write a virus that gets other people to send the email for 
 you, or find an open relay, or take over someone's insecure 
 computer on a cable modem or DSL network...
 
 
 -- 
 Erik Reuter   http://www.erikreuter.net/
 ___
 http://www.mccmedia.com/mailman/listinfo/brin-l
 

___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Julia Thompson
[EMAIL PROTECTED] wrote:
 
 In a message dated 4/2/2004 5:11:04 PM US Mountain Standard Time,
 [EMAIL PROTECTED] writes:
 
  Debbi
  Off To The Symphony Now Maru
 
 
 I want to know what was playing.
 
 But if it aint Baroque, don't fax it.
 
 Vilyehm
 -
 Falls asleep to most Mahler.

As long as you don't snore in the concert hall, not a problem.

I had a boyfriend once who told me his dad would fall asleep at the
symphony.  His snoring was in time to the music, though, at least.  :) 
My own dad wasn't quite as musically inclined in his sleep, then again,
the piece he fell asleep for wasn't any great shakes.  (He was awake for
all of the piece we were there for me to hear, at least.)

I haven't listened to any Mahler in awhile.  Not sure how Catherine
would like it.

Julia

OD'ing on Smash Mouth lately
___
http://www.mccmedia.com/mailman/listinfo/brin-l


Re: Virus infection alert !

2004-04-02 Thread Medievalbk
In a message dated 4/2/2004 9:53:00 PM US Mountain Standard Time, 
[EMAIL PROTECTED] writes:

 Falls asleep to most Mahler.
 
 As long as you don't snore in the concert hall, not a problem.
 
 

My impression on Mahler is that it's a good half hour piece stretched out to 
an hour and twenty minutes because he was being paid by the note.

My main problem in a concert hall would be in refraining from yelling out 
foyer! in a crowded lobby.

More Hoffnung!

William Taylor
___
http://www.mccmedia.com/mailman/listinfo/brin-l