OT Recent virus

[John E. Malmberg]

ian j hart wrote:
> Can someone confirm the MIME headers included
> 
>         name="Movie_0074.mpeg.pif"
>         filename="Movie_0074.mpeg.pi"
> 
> ie filename missing f

No, because one of my postmasters that this list goes through has a 
scanner that removed the virus and replaced it with a text file.


It appears that the original virus came from uky.edu, and I sent a 
report to that postmaster.

The second virus came from bellsouth.net, possibly a secondary 
infection.  Reports to their support contacts have been made.

The third came from comcast.net.  A report has been made to that postmaster.

And really, only the samba.org virus scanner should be making reports to 
the mailing list.  If you are not samba.org, and you recognize your 
postmaster's virus scanner, please get them to fix it.

Virus scanners and any other automatic responders should never send out 
messages to mailing lists.

Just think what would happen if everyone that had a virus scanner 
bounced a message back to this list.  It would probably take a day just 
to delete them all to get to the real messages.

And since viruses typically are forging the from: part of the message, 
having a virus scanner bounce a message back automatically is bad.  It 
is not going to the source, but most likely to someone who is not infected.

It is appropriate for a samba.org virus scanner to make notifications. 
Unfortunately, it appears to be detecting the virus after it has been 
e-mail out.

-John
wb8tyw at qsl.network
Personal Opinion Only