Thread Name: VIRUS ATTACHED TO AN EMAIL FROM MODLIB@ALGOL ETC!?!? From: "John Wolansky" <jwol@removed> Date: Thu, 29 Jan 2004 08:24:29 -0500 In a batch of eMails I received this AM, two were infected with the W32.NOVARG.A@MM.VIRUS virus. One of the eMails is from the modlib listserve, or at least it appears to be. Note that it indicates it was sent from the ML listserve on my behalf. Any thoughts from the list serve moderator? My regularly updated Norton Anti-Virus picked it up. For your information, I am responding to the eMail I received, sans the infected virus. ------------------------------------- From: j b krygier <jbkrygie@removed> Date: Thu, 29 Jan 2004 09:11:38 -0500 The list (and just about everybody in the world) is being bombarded by these emails (the direct result of our dependence on a computer operating system monoculture). About 30 per day are being rejected by MODLIB (which rejects almost any email with an attachment). Tricky thing about the recent bach of viri is that they may say they are from a particular address (such as MODLIB) but they are not (or at least this is what I was told by our infosystems folks). I checked and I don't see any emails in my mailer from MODLIB with the virus (except those that were rejected). I set the maximum number of characters allowed in a MODLIB posting to 5000 - and this should eliminate all emails with attachments (the attached file, and all its characters, count in this total). This should eliminate all postings with the virus attachment. ------------------------------------- From: Scot Kamins <kamins@removed> Date: Thu, 29 Jan 2004 08:17:15 -0800 At 9:11 AM -0500 1/29/04, j b krygier wrote: >Tricky thing about the recent bach of viri is that they >may say they are from a particular address (such as MODLIB) >but they are not (or at least this is what I was told by our >infosystems folks). Yeah. It's called "spoofing." In effect, a batch of e-mail addresses are hijacked and randomly inserted into the "from" field of letters sent out by the virus. The more clever viruses hijack your e-mail Address list from your computer and send replicant viruses to everyone on the list using YOUR e-mail return address, letting you think you can open an attachment with impunity. By the way, people with Macintoshes running the MAC OS need not worry. >I set the maximum number of characters >allowed in a MODLIB posting to 5000 Damn! There goes my latest screed on those auctioneers on eBay who would defame our Finest. -------------------------------------