Postgres Pro
Downloads
Home   >   mailing lists

Thread: clean up time!

clean up time!

From
tony
Date:
From:     pgadmin-support <pgadmin-support@postgresql.org>
To:     tony@animaproductions.com
Subject:     Hello,tony,how are you

Someone out there has an infected Windows machine...

Before it starts sending empty mail to all the members of the list it
might be a good idea that the Windows users do a quick virus check.

TIA

Tony

--
RedHat Linux on Sony Vaio C1XD/S
http://www.animaproductions.com/linux2.html
Macromedia UltraDev with PostgreSQL
http://www.animaproductions.com/ultra.html

Re: clean up time!

From
Curt Sampson
Date:
On 8 Jul 2002, tony wrote:

> From:     pgadmin-support <pgadmin-support@postgresql.org>
> To:     tony@animaproductions.com
> Subject:     Hello,tony,how are you
>
> Someone out there has an infected Windows machine...
>
> Before it starts sending empty mail to all the members of the list it
> might be a good idea that the Windows users do a quick virus check.

You can find out who it is by looking at the envelope sender of the message;
klez.H does not disguse that, for some reason. (This is usually in the
full headers somewhere.)

This virus is pretty tenacious. though. I've been getting 2-4 per
day for a couple of months now.

cjs
--
Curt Sampson  <cjs@cynic.net>   +81 90 7737 2974   http://www.netbsd.org
    Don't you know, in this new Dark Age, we're all light.  --XTC

Re: clean up time!

From
Bruce Momjian
Date:
Curt Sampson wrote:
> On 8 Jul 2002, tony wrote:
>
> > From:     pgadmin-support <pgadmin-support@postgresql.org>
> > To:     tony@animaproductions.com
> > Subject:     Hello,tony,how are you
> >
> > Someone out there has an infected Windows machine...
> >
> > Before it starts sending empty mail to all the members of the list it
> > might be a good idea that the Windows users do a quick virus check.
>
> You can find out who it is by looking at the envelope sender of the message;
> klez.H does not disguse that, for some reason. (This is usually in the
> full headers somewhere.)
>
> This virus is pretty tenacious. though. I've been getting 2-4 per
> day for a couple of months now.

I have blocked it using sendmail because the MIME tag is always just
random letters:

    # Klez
    Kchkcontent3 regex -a@REJ
    multipart/alternative;.*boundary=[A-Za-z0-9]{10,}$

I would like to have found a better signature but that is the only
reliable one I have found.

Full info at:

    http://candle.pha.pa.us/main/writings/spam/

--
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026