CPHennessy wrote:
>On Saturday 06 August 2005 07:48, Robert Stemp wrote: > > >>To whom it may concern: >>I am subscribed to the OpenOffice.org Users mailing list and I have >>noticed that there is a lot of e-mail sent from one user at your domain. >>The e-mail address is [EMAIL PROTECTED] The >>e-mails sent by this address always have attachments (the list server >>removes all attachments but if there is an attachment, it replaces it >>with a text file). The body of the e-mails makes them appear to be sent >>by a mass-mailing e-mail virus/worm. It is possible that someone is >>stealing the domain name, but I would request you look into this. I am >>not an admin for the list, but I feel that if your network is being >>misused that you should be informed of it. I am sorry that this is in >>English, I know zero Russian or Belarusian. >> >> > >Thanks Robert, > I've asked the providers of our email list facilities to look into this only >a few hours ago :) It's in Issuetracker if you want to have a look at the >progress of this issue. > > > After looking at the information posted in Issuetracker, the headers that were posted with the message were the headers from Collabnet (the mailing list server). When I first noticed these e-mails I tried to see if the address was spoofed but the original headers are removed (for security reasons, which is a good thing) and the list-serv headers are added. You need who ever is looking into this to get the original, intact headers for the e-mail to determine if it is from a user at the Institute for Applied Physics at the Belarus National Academy of Science, or, from what I could get on-line at Symantec, a spoofed e-mail address by a Netsky mass mailing virus variant. Robert
