At 10:07 AM 23/04/02 -0700, Chuq Von Rospach wrote:
This is an emerging worm, and it looks pretty ugly. It has hit Hong Kong and Great Britain worst so far, but it's spreading rapidly accordind to people I've talked to.
I have to say, I've seen it already quite a bit on some of the linuxchix mailing lists. Mostly it's getting caught by our "posters-only" rules, but we're also getting sent "You have a virus" auto-messages to the lists, the admins, and probably random posters as well. I haven't seen any make it through to the lists I'm on yet, but it's probably only a matter of time before someone's copy chooses a valid From: address.
I hadn't gone to look up the details on it yet, but I figured it was forging From:'s when I saw a mail purportedly from an older address belonging to our coordinator, who lives in Australia, coming from an ISP which is local to me, halfway around the world in Canada. I haven't been tracing ISPs, but I'm guessing it's spread over the US by now.
Thanks for the extra info, Chuq. I should probably make a similar notice available before I start getting complaints.
Terri