Frankie wrote:
My question is how in gods name was sobigs smtp engine able to send mail to the list?
I ask because if it doesn't resolve the IP, mandrakes sympa won't accept the post..
I am guessing that sobig uses the SMTP server of the infected lookout????
rgds
Franki
Mandrake Gamers mailing list: htmlfixit.com/mailman/listinfo/mandrake-games
HTML Perl PHP n stuff.. htmlfixit.com
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David E. Fox Sent: Monday, 8 September 2003 12:52 AM To: [EMAIL PROTECTED] Subject: Re: [newbie] Virus - let's go over this again, shall we?u
But since we're on the subject of viruses, and since I've been way to busy to read every single last post on this subject, I'd like to ask one thing. Has anyone told the list that an infected email received on this list may not have come from the person named? These types of viruses will (if activated on a
Well yep. That's a given. FWIW 2 SoBig's have just come through on newbie. Spamassassin is clever enough now to automatically put them in my caughtspam file - but I've seen no less than seven of these come through over the past few days. One of the last two had a return address of juno.com.
They're all about the same simes - some 1700 lines.
So, if I'm in Stephen or Frankie's address books, I'm safe (because they use Linux, and NOT Outlook, or Outlook Express!
Well, that's the way these things propagate. I don't use address books at home. I just remember the address of whom I'm sending :). Or maybe kmail remembers it for me, since I can type the first few letters of the email address and it supplies the rest. People using Outhouse tend to keep a lot of email addresses in the contacts folders - especially if they're at work. Those lists do come in handy, and keeping all the data for your biz partners is certainly useful -- but that is how these things spread. The worm contacts every email address in the contact list, then goes to the other pc, where it contacts everyone in that list, and so on. And eventually it hit someone using Outhouse that had [EMAIL PROTECTED] mandrake.com in the list.
So two morals -- don't use Outhouse, and don't put mailing list email addresses in your contacts.
Needless to say, John's day's are numbered at this point, and I wouldn't want to be in his shoes when "Guido" (also not his real
Shit, that's what the Windows users are doing now. Paying for protection. Guido == McAfee in this instance.
Lanman
------------------------------------------------------------------------ David E. Fox Thanks for letting me [EMAIL PROTECTED] change magnetic patterns [EMAIL PROTECTED] on your hard disk. -----------------------------------------------------------------------
------------------------------------------------------------------------
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
-- David Filion V.P. Technology Maximum Lans Inc. [EMAIL PROTECTED] (514) 489-7825 6915 Fielding Ave. Suite # 228 Montreal, Quebec, H4V 1P4
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
