Market Farming

["Paul A. Bock" <bockpa AT plesh.com>]

Hello,
  I must have deleted close to a couple hundred emails with these
attachments yesterday.

  Then I started getting messages from sophisticated mail handling servers
telling me that a certain mail message sent from me contained one of these
*.pif files containing the sobig.F virus.  Now my email doesn't filter these
things out very well, but we have heavy virus protection software running
realtime as well as regular static checks of all files.  So I knew I didn't
have the virus and I was diligently removing the bad email from my mailbox.

  I read up on this virus and it does some weird things.  For instance when
it actually infects a host it will look for as many email addresses as it
can on that host machine.  It then picks one of the email addresses and
sends out tons of emails from the host, but forges all the outgoing mail
with this alternate address as the sender.  So most of the time, with this
one particular virus, you are not receiving the email from the "sent from"
email account.  But whoever you did get it from, had that person's email
address somewhere on their machine.  This is meant to slow down the tracking
of the email trail back to the infected machines.

  Then it puts different things in the subject line and renames the
attachment file (though always seems to be a *.pif file) so that it can get
around a filter on a particular subject line or filename.

--Paul Bock
  Stone Gully



-----Original Message-----
From: market-farming-bounces AT lists.ibiblio.org
[mailto:market-farming-bounces AT lists.ibiblio.org]On Behalf Of Liz Pike
Sent: Thursday, August 21, 2003 7:04 AM
To: Market Farming
Subject: [Market-farming] ADMIN: viruses


Once again a virus is circulating which I'm sure you've all heard more than
enough about.  Only problem is my website address,
webmaster AT marketfarming.com is being used as one of the "from" addresses.
The stupid virus doesn't know that this isn't a real email addy, it's coded
different, and is only on the website, which means the virus is spidering
websites, boards and anywhere else your email address is visible.

Once again, for those not protected, get virus protection on your computer,
preferably one that scans outgoing mail also.

If you get emails with the subject lines of "Thank you", "Wicked Screen
Saver", "Approved", don't open, delete.

Liz Pike
List Administrator
Laughingbrook Farm
Westfield NC
http://www.marketfarming.com
http://www.laughingbrookfarm.com


P.S. the first person who says "Mac" or "Linux" gets the whole world wide
web emailed to them!  ; )))


_______________________________________________
Market-farming mailing list
Market-farming AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/market-farming

Get the list FAQ at: http://www.marketfarming.net/mflistfaq.htm