pg.ddx.io pgsql-sql@postgresql.org mailing list archive
help / color / mirror / Atom feedvirus warning
10+ messages / 7 participants
[nested] [flat]
* virus warning
@ 2003-09-19 06:17 Tomasz Myrta <jasiek@klaster.net>
2003-09-19 08:34 ` Re: virus warning Richard Huxton <dev@archonet.com>
2003-09-19 09:38 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
0 siblings, 2 replies; 10+ messages in thread
From: Tomasz Myrta @ 2003-09-19 06:17 UTC (permalink / raw)
To: pgsql-sql
Hi
Recently I receive massive mail attack. This attack comes from some
postgresql mailing list users. All send-to adresses are taken from users
mailboxes which contain postgresql posts. Currently I found two kinds of
viruses:
1. Empty post with "Undelivered message to..." body
2. Microsoft "Dear Customer... " based on www.microsoft.com design.
Both mails contains some .exe attachement.
Regards,
Tomasz Myrta
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
@ 2003-09-19 08:34 ` Richard Huxton <dev@archonet.com>
2003-09-19 10:49 ` Re: virus warning Christopher Browne <cbbrowne@acm.org>
1 sibling, 1 reply; 10+ messages in thread
From: Richard Huxton @ 2003-09-19 08:34 UTC (permalink / raw)
To: Tomasz Myrta <jasiek@klaster.net>; pgsql-sql
On Friday 19 September 2003 07:17, Tomasz Myrta wrote:
> Hi
> Recently I receive massive mail attack. This attack comes from some
> postgresql mailing list users. All send-to adresses are taken from users
> mailboxes which contain postgresql posts. Currently I found two kinds of
> viruses:
> 1. Empty post with "Undelivered message to..." body
> 2. Microsoft "Dear Customer... " based on www.microsoft.com design.
> Both mails contains some .exe attachement.
I've been getting something similar myself. Roughly 100 per day.
--
Richard Huxton
Archonet Ltd
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 08:34 ` Re: virus warning Richard Huxton <dev@archonet.com>
@ 2003-09-19 10:49 ` Christopher Browne <cbbrowne@acm.org>
2003-09-19 11:55 ` Re: virus warning Tomasz Myrta <jasiek@klaster.net>
0 siblings, 1 reply; 10+ messages in thread
From: Christopher Browne @ 2003-09-19 10:49 UTC (permalink / raw)
To: pgsql-sql
The world rejoiced as dev@archonet.com (Richard Huxton) wrote:
> I've been getting something similar myself. Roughly 100 per day.
Only 100, eh? I have been seeing that many per hour, give or take...
--
"aa454","@","freenet.carleton.ca"
http://cbbrowne.com/info/x.html
People can be set wondering by loading obscure personal patchable
systems, and sending bug reports. Who would not stop and wonder upon
seeing "Experimental TD80-TAPE 1.17, MegaDeath 2.5..."? The same for
provocatively-named functions and variables in stack traces.
-- from the Symbolics Guidelines for Sending Mail
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 08:34 ` Re: virus warning Richard Huxton <dev@archonet.com>
2003-09-19 10:49 ` Re: virus warning Christopher Browne <cbbrowne@acm.org>
@ 2003-09-19 11:55 ` Tomasz Myrta <jasiek@klaster.net>
0 siblings, 0 replies; 10+ messages in thread
From: Tomasz Myrta @ 2003-09-19 11:55 UTC (permalink / raw)
To: Christopher Browne <cbbrowne@acm.org>; +Cc: pgsql-sql
> The world rejoiced as dev@archonet.com (Richard Huxton) wrote:
>
>>I've been getting something similar myself. Roughly 100 per day.
>
>
> Only 100, eh? I have been seeing that many per hour, give or take...
If it will help someone, I found that The Microsoft Virus is called
"Swen" or "Gibe". It attacks (as usual) Internet Explorer without proper
patches.
Regards,
Tomasz Myrta
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
@ 2003-09-19 09:38 ` Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-19 09:53 ` Re: virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 15:37 ` Re: virus warning scott.marlowe <scott.marlowe@ihs.com>
1 sibling, 2 replies; 10+ messages in thread
From: Paul Thomas @ 2003-09-19 09:38 UTC (permalink / raw)
To: pgsql-sql
On 19/09/2003 07:17 Tomasz Myrta wrote:
> Hi
> Recently I receive massive mail attack. This attack comes from some
> postgresql mailing list users. All send-to adresses are taken from users
> mailboxes which contain postgresql posts. Currently I found two kinds of
> viruses:
> 1. Empty post with "Undelivered message to..." body
> 2. Microsoft "Dear Customer... " based on www.microsoft.com design.
> Both mails contains some .exe attachement.
>
> Regards,
> Tomasz Myrta
So far I've had nearly 150 of these in the last 12 hours or so. Somebody
on these lists has a lot of explaining to do! Fortunately my spam filters
are up to scratch and I run Linux :) Others may not be so lucky.
--
Paul Thomas
+------------------------------+---------------------------------------------+
| Thomas Micro Systems Limited | Software Solutions for the Smaller
Business |
| Computer Consultants |
http://www.thomas-micro-systems-ltd.co.uk |
+------------------------------+---------------------------------------------+
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 09:38 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
@ 2003-09-19 09:53 ` Tomasz Myrta <jasiek@klaster.net>
2003-09-19 12:11 ` Re: virus warning Rudi Starcevic <rudi@oasis.net.au>
1 sibling, 1 reply; 10+ messages in thread
From: Tomasz Myrta @ 2003-09-19 09:53 UTC (permalink / raw)
To: Paul Thomas <paul@tmsl.demon.co.uk>; +Cc: pgsql-sql
> So far I've had nearly 150 of these in the last 12 hours or so. Somebody
> on these lists has a lot of explaining to do! Fortunately my spam
> filters are up to scratch and I run Linux :) Others may not be so lucky.
Currently I've found 45 different Return-Path values in these posts and
it's growing :-(
Regards,
Tomasz Myrta
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 09:38 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-19 09:53 ` Re: virus warning Tomasz Myrta <jasiek@klaster.net>
@ 2003-09-19 12:11 ` Rudi Starcevic <rudi@oasis.net.au>
0 siblings, 0 replies; 10+ messages in thread
From: Rudi Starcevic @ 2003-09-19 12:11 UTC (permalink / raw)
To: pgsql-sql
Hi,
Yeah me too - about 150 so far today.
I was thinking it's from my Debian mailing lists not PostgreSQL.
Strange people these stoooopid virus spammers.
Good luck with it all.
Regards
Rudi.
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 09:38 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
@ 2003-09-19 15:37 ` scott.marlowe <scott.marlowe@ihs.com>
2003-09-19 22:14 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
1 sibling, 1 reply; 10+ messages in thread
From: scott.marlowe @ 2003-09-19 15:37 UTC (permalink / raw)
To: Paul Thomas <paul@tmsl.demon.co.uk>; +Cc: pgsql-sql
On Fri, 19 Sep 2003, Paul Thomas wrote:
>
> On 19/09/2003 07:17 Tomasz Myrta wrote:
> > Hi
> > Recently I receive massive mail attack. This attack comes from some
> > postgresql mailing list users. All send-to adresses are taken from users
> > mailboxes which contain postgresql posts. Currently I found two kinds of
> > viruses:
> > 1. Empty post with "Undelivered message to..." body
> > 2. Microsoft "Dear Customer... " based on www.microsoft.com design.
> > Both mails contains some .exe attachement.
> >
> > Regards,
> > Tomasz Myrta
>
> So far I've had nearly 150 of these in the last 12 hours or so. Somebody
> on these lists has a lot of explaining to do! Fortunately my spam filters
> are up to scratch and I run Linux :) Others may not be so lucky.
Keep in mind, if you check the headers on the emails you'll see that they
are forged. I've been getting about 20 emails a day telling me a message
I know I didn't send was infected with a virus.
I got 432 last night inbound, some with names forged from this list,
others from names unknown.
But I don't think it's not the folks on this list, I think it's a
windows worm that looks in people's email, harvests names at random, and
forged email based on it.
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 09:38 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-19 15:37 ` Re: virus warning scott.marlowe <scott.marlowe@ihs.com>
@ 2003-09-19 22:14 ` Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-20 00:04 ` Re: virus warning Yasir Malik <ymalik@cs.stevens-tech.edu>
0 siblings, 1 reply; 10+ messages in thread
From: Paul Thomas @ 2003-09-19 22:14 UTC (permalink / raw)
To: pgsql-sql
On 19/09/2003 16:37 scott.marlowe wrote:
>
> Keep in mind, if you check the headers on the emails you'll see that they
>
> are forged. I've been getting about 20 emails a day telling me a message
>
> I know I didn't send was infected with a virus.
>
> I got 432 last night inbound, some with names forged from this list,
> others from names unknown.
>
> But I don't think it's not the folks on this list, I think it's a
> windows worm that looks in people's email, harvests names at random, and
> forged email based on it.
Does seem to be. Just download another 200+. Mildly anoying for me with a
DSL line. I really feel for those on dial-up :(
--
Paul Thomas
+------------------------------+---------------------------------------------+
| Thomas Micro Systems Limited | Software Solutions for the Smaller
Business |
| Computer Consultants |
http://www.thomas-micro-systems-ltd.co.uk |
+------------------------------+---------------------------------------------+
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: virus warning
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 09:38 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-19 15:37 ` Re: virus warning scott.marlowe <scott.marlowe@ihs.com>
2003-09-19 22:14 ` Re: virus warning Paul Thomas <paul@tmsl.demon.co.uk>
@ 2003-09-20 00:04 ` Yasir Malik <ymalik@cs.stevens-tech.edu>
0 siblings, 0 replies; 10+ messages in thread
From: Yasir Malik @ 2003-09-20 00:04 UTC (permalink / raw)
To: Paul Thomas <paul@tmsl.demon.co.uk>; +Cc: pgsql-sql
Thank god that I use Pine.
Yasir
On Fri, 19 Sep 2003, Paul Thomas wrote:
> Date: Fri, 19 Sep 2003 23:14:54 +0100
> From: Paul Thomas <paul@tmsl.demon.co.uk>
> To: "pgsql-sql @ postgresql . org" <pgsql-sql@postgresql.org>
> Subject: Re: [SQL] virus warning
>
> On 19/09/2003 16:37 scott.marlowe wrote:
> >
> > Keep in mind, if you check the headers on the emails you'll see that they
> >
> > are forged. I've been getting about 20 emails a day telling me a message
> >
> > I know I didn't send was infected with a virus.
> >
> > I got 432 last night inbound, some with names forged from this list,
> > others from names unknown.
> >
> > But I don't think it's not the folks on this list, I think it's a
> > windows worm that looks in people's email, harvests names at random, and
> > forged email based on it.
>
> Does seem to be. Just download another 200+. Mildly anoying for me with a
> DSL line. I really feel for those on dial-up :(
>
> --
> Paul Thomas
> +------------------------------+---------------------------------------------+
> | Thomas Micro Systems Limited | Software Solutions for the Smaller
> Business |
> | Computer Consultants |
> http://www.thomas-micro-systems-ltd.co.uk |
> +------------------------------+---------------------------------------------+
>
> ---------------------------(end of broadcast)---------------------------
> TIP 8: explain analyze is your friend
>
^ permalink raw reply [nested|flat] 10+ messages in thread
end of thread, other threads:[~2003-09-20 00:04 UTC | newest]
Thread overview: 10+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2003-09-19 06:17 virus warning Tomasz Myrta <jasiek@klaster.net>
2003-09-19 08:34 ` Richard Huxton <dev@archonet.com>
2003-09-19 10:49 ` Christopher Browne <cbbrowne@acm.org>
2003-09-19 11:55 ` Tomasz Myrta <jasiek@klaster.net>
2003-09-19 09:38 ` Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-19 09:53 ` Tomasz Myrta <jasiek@klaster.net>
2003-09-19 12:11 ` Rudi Starcevic <rudi@oasis.net.au>
2003-09-19 15:37 ` scott.marlowe <scott.marlowe@ihs.com>
2003-09-19 22:14 ` Paul Thomas <paul@tmsl.demon.co.uk>
2003-09-20 00:04 ` Yasir Malik <ymalik@cs.stevens-tech.edu>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox