Subject: [Asrg] Re: 0. General - Virus Alert - Followup

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 21 Aug 2003 17:37:02 -0400

At 12:07 PM 8/21/2003, Yakov Shafranovich wrote:
>........Some group members reported receiving the virus at the email 
>addresses used only for ASRG activity, so it seems that some of the list 
>members have been infected. ........

Just to follow up - I have been getting copies of the virus with the 
[email-masked] return address. This indicates that someone on the list IS 
INFECTED. The IP Address of the computer is 68.154.45.203 and the resolved 
name is adsl-154-45-203.asm.bellsouth.net. Full headers are below:

---snip----
From: <[email-masked]>
To: <[email-masked]>
Subject: Thank you!
Date: Thu, 21 Aug 2003 17:29:03 --0400
Importance: Normal
---snip----  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Margie <[email-masked]>
Date: Thu, 21 Aug 2003 15:02:33 -0700

--On Thursday, August 21, 2003 5:37 PM -0400 Yakov Shafranovich 
<[email-masked]> wrote:

> Just to follow up - I have been getting copies of the virus with
> the [email-masked] return address. This indicates that someone on
> the list IS INFECTED.

Not really. It indicates that there is a *possibility* that someone 
on the list is infected.

Then again it could be someone that visited the web archive, or 
google, or the ietf site or slashdot, or some other website with that 
address on it, or reads comp.mail.sendmail, or nanae, or spam-l, or 
had someone forward a post to them.  The worm scrapes anything that 
looks like an email address from a variety of file types, including 
.eml, .html, .htm, .txt .....

We're getting them sent to weird reference numbers that go out in the 
body of mail.

-- 
Margie

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 21 Aug 2003 18:12:11 -0400

At 06:02 PM 8/21/2003, Margie wrote:

>Not really. It indicates that there is a *possibility* that someone on the 
>list is infected.
>
>Then again it could be someone that visited the web archive, or google, or 
>the ietf site or slashdot, or some other website with that address on it, 
>or reads comp.mail.sendmail, or nanae, or spam-l, or had someone forward a 
>post to them.  The worm scrapes anything that looks like an email address 
>from a variety of file types, including .eml, .html, .htm, .txt .....
>
>We're getting them sent to weird reference numbers that go out in the body 
>of mail.

Thank you for the correction.