Tour of All Petite - virus warning - new info and a request for all

[Martin X. Moleski, SJ]

<rcpilotjohn at wideopenwest.com> wrote:

> Could I ask anyone else who received one or both of these emails 
> to reply directly to me (rcpilotjohn at wideopenwest.com) and send 
> me the header from that email (if you still have it around). 

Sorry.  I delete things quickly.  I am quite sure that I did
not receive the Tour of All Petite "from" discussion at nsrca.org.

> ... it is very unlikely that my email address was in their 
> address books.

I use Mulberry, which is a very peculiar IMAP e-mail program.
It does not harvest addresses automatically.  I think I have
seen others that do--every address gets put into some kind
of address book.  (Please don't shoot me if I'm wrong about
that.  I only saw this behavior once on a friend's machine,
and I may have been hallucinating.)

> Unless someone out there has both my address and the other 
> people listed above in their lists, which is a possibility 
> I guess.

Right.  That's how klez and bugbear work.  They take TWO
addresses from the infected machine: one to send themselves
TO, and one to pretend to send themselves FROM.  This makes
it hard for people to track down the infected machine and
therefore the worm lives longer and does more damage.

						Marty #2874
=====================================
# To be removed from this list, send a message to 
# discussion-request at nsrca.org
# and put leave discussion on the first line of the body.
#