> >What has happened is a digest subscriber to that list has recently become >infected with a virus. The virus, being the devious little thing that it is, >then does the following: > >1) picks out a user name from an address book entry (in this case, >pci-powermacs, originating from [EMAIL PROTECTED]) >2) picks out a domain from an address book entry (in this case, someone whose >e-mail is @netnitco.net) >3) combines those to create an return e-mail address (what you see above) >4) appends the beginning of an e-mail (probably the one used to harvest the >user name, based on the fact that I have yet to see this with something >*other* >than a PCI-Powermacs digest as its contents) to a new e-mail message >5) sets the subject of this e-mail message to that of the harvested e-mail >(in >the two cases where I got it, a PCI-Powermacs digest) >6) sends the e-mail to everyone in that person's address book, using the >faked >from: address. > >Having examined the headers on the e-mail, I know - or have a pretty damn >good >idea - of *exactly* who is responsible for this. I've let the listmom >know and >I've told the guy he needs to run a virus scan on his Windoze box. >-- > >the pickle
Oh no! It's not me is it? I'm guessing I'm the only person on any of these lists with a netnitco.net address. If it is, (off topic now) how would I go about finding the virus? I'm using an SE/30 with system 7.1 and Claris Emailer 1.1.3 to handle the email for these lists (Compact Macs, Vintage Macs, QuadList, 1st PPC, PCI PPC, G list and LEM Swaplist) Would such a virus exist? For what it's worth, I've only got the posting addresses for the vatious lists and a few family email addresses in my address book. I don't think I've got any list members' addresses in it at all. If it's not me, and if I am the only subscriber with a netnitco.net (netnitco is a small ISP serving NW Indiana; it has about 10 access numbers), then I'm guessing based on what pickle said above, that whoever it is has emailed me in the past, probably more just a reply (if I'm in their address book), and is subscribed to PCI-Powermacs list. J White Buy American S.O.S. Save Our Steel -- Quadlist is sponsored by <http://lowendmac.com/> and... Small Dog Electronics http://www.smalldog.com | Enter To Win A | -- Canon PowerShot Digital Cameras start at $299 | Free iBook! | Support Low End Mac <http://lowendmac.com/lists/support.html> Quadlist info: <http://lowendmac.com/lists/quadlist.shtml> The FAQ: <http://macfaq.org/> --> AOL users, remove "mailto:"; Send list messages to: <mailto:[EMAIL PROTECTED]> To unsubscribe, email: <mailto:[EMAIL PROTECTED]> For digest mode, email: <mailto:[EMAIL PROTECTED]> Subscription questions: <mailto:[EMAIL PROTECTED]> Archive: <http://www.mail-archive.com/quadlist%40mail.maclaunch.com/> Using a Mac? Free email & more at Applelinks! http://www.applelinks.com
