Re: [Bug-gnubg] more viruses!

[Jim Segrave]

On Sat 22 Mar 2003 (12:01 -0000), Ian Shaw wrote:
> 
> > From: address@hidden
> > [mailto:address@hidden Behalf Of Joern
> > Thyssen
> 
> > Hi all,
> > 
> > I've written an email to address@hidden, 
> > providing the mail
> > headers from the latest email containing viruses originating from
> > mindspring.net (aka earthlink.net). Hopefully it's enough information
> > they need to find the customer sending viruses to the mailing list!
> > 
> > Jørn
> > 
> Hmm, I know Neilkaz has an earthlink address. I wonder if some spammer has 
> got into his PC and found the mailing list address there. N.B. I am 
> definitely not accusing Neil of spamming this group; it's just that the 
> domain name rang a bell - we wouldn't would Neil shut down by his ISP, would 
> we!

I'd prefer it if someone who runs the mailing list could get the full
headers of the incoming emails. There are several viruses which forge
outbound email with addresses taken from the address books of the
infected machine. This can give the appearance that you are spreading
a virus, because you emailed someone who subsequently had their
machine infected. I only trust the IP addresses in the Received:
headers to give me a way of tracking where an email originated, and
even then, you can only trust the first few (for example, I know how
our machines are configured, so if I get spam/virus emails, I know
that the IP address of the first external machine sending to an
nl.demon.net address is correct. Received headers below that one are
less and less trustworthy.

-- 
Jim Segrave           address@hidden