I got the infected message this morning too Glenn. There's some strange stuff going on at the moment, and some are suspecting a server near the NSW Synod/Assembly office might be infected. The IT team there are pretty good, but it wouldn't be the first time a virus has originated from the Assembly.
>From reading the mail headers, the email message purporting to be from Tom appears to have originated at a server called terencec-assem.org [203.36.206.69], before being forwarded to the server that hosts the Insights list. That IP address also resolves to a server called bruce.uca.org.au. That's why is seems near to the Assembly/NSWSynod; if the message originated from a server 'behind' the Assembly server, there would probably be a record of that in the headers too, but there's not. There's no way a virus could delay when the Insights list server sends out messages, unless that list server got infected (which I strongly doubt) and even then it's an unlikely tactic for a virus. Most viruses and worms are more concerned to send themselves out as broadly and rapidly as possible. However the Insights list server might have been unable to connect to the mail server for particular list members at particular times, so some delays may be present as part of the natural flow of email through an asynchronous and unmanaged network (ie. the Internet). And that may be why you didn't get the earlier virus-carrying message Glenn; some Insights messages never make it to my InBox, I just see the conversation thread continuing afterwards. Regards, Rohan Rohan Pryor Manager, Information Technology Services Synod of Victoria and Tasmania Uniting Church in Australia Email: [EMAIL PROTECTED] Ph: (03) 9251 5243 Fax: (03) 9654 4110 Website: http://vic.uca.org.au -----Original Message----- From: Katy & Glenn Martin [SMTP:[EMAIL PROTECTED] Sent: Friday, August 20, 2004 11:21 AM To: 'insights-l' Subject: Virus in message purportedly from Tom I know this has been discussed previously, but I have only this morning at 9:33am received the message from Tom which my virus checker reported: From: "Tom" <[EMAIL PROTECTED]> Subject: Re: Virus Name: ZIP.Bagle Details: Garry.zip - ZIP.Bagle worm. Removed. The message shows the To: address as Insights-l, so I presume that it went to all, but as I don't recall receiving the virus message referred to in the discussion in recent weeks, I wondered whether this virus can somehow delay the time each person on the Insights-L list receives the message. Can any of the computer gurus explain how this could occur, or did we all receive this as a new virus message this morning? If so, if anyone's virus checker has not notified that the message purportedly from Tom contained the ZIP.Bagle worm in the attachment Garry.zip and /or removed the attachment, you should update your virus checker. You should also ensure you delete the message titled Re: without opening the attachment. Glenn << File: ATT00016.html >> ------------------------------------------------------ - You are subscribed to the mailing list [EMAIL PROTECTED] - To unsubscribe, email [EMAIL PROTECTED] and put in the message body 'unsubscribe insights-l' (ell, not one (1)) See: http://nsw.uca.org.au/insights-l-information.htm ------------------------------------------------------
