[TECnewhw] URGENT - VIRUS ATTACHMENT IN LAST EMAIL

Trevor Cordes trevor at tecnopolis.ca
Thu Mar 11 21:22:32 CST 2004


This is an urgent message to all my customers on this mailing list.  You 
probably just received an email from this mailing list containing a virus.  
The subject was "[TECnewhw] information".  The attachment is a virus.  Do 
not run/open the attachment.

I am taking steps to ensure this does not happen again.

If you are interested in the technical explanation:

This virus made it onto the list by being posted by someone on my mailing 
list who was spoofing the From address and pretending to be me.  Normally 
only I have access to post to this list, but it only verifies this by 
looking at the From address (which is easily spoofed).  I am going to 
change it so that all emails must be approved by me before going to the 
list.  That will ensure this does not happen again (though it means extra 
steps for me when I want to send emails to the list).

I don't think this situation was caused purposely, it probably is just a
virus on a customer's computer that is automatically harvesting emails and
trying to spread.  I know from the headers that the email was originally 
sent from an IP address that ends with .98.  If that is you, then you have 
a virus!

Also, this must be a new(ish?) virus as I have not seen this type of 
approach to the from, subject and body headers before.

Once again, this underscores the need for good up to date Anti Virus 
software.  The current virus situation is totally out of control.


More information about the TECnewhw mailing list