[Pythonmac-SIG] Somebody probably has a virus, please check!

[Kevin Altis]

This is getting pretty bad, so I'll make a few suggestions on the assumption
that this is a result of an Outlook user on Windows. As Jack mentioned, they
might not be an Outlook user actually on this list or even using Outlook,
but there is a high probability they are.

1. If you're running Outlook and you never patched it so unsafe attachments
are automatically deleted, then I suggest you do so. Yes, you won't be able
to have people send you .exe, .pif, .reg, .vbs, etc. files without putting
them in some non-executable format like a .zip, but then again nobody should
be legitimately sending you that kind of dangerous attachment anyway. This
patch has been available for over two yearse, so update already and save
yourself some grief.

  http://office.microsoft.com/ProductUpdates/default.aspx

2. Check your Send Items folder and see if things have gone out that you
didn't send yourself. I'm not sure the current crop of viruses will leave a
trace in there, but it doesn't hurt to check.

3. We could scan the archives for current subscribers using Outlook as their
mail client and then notify those people (yes I'm one of them) that they
need to do a virus scan... The header to look for is "X-Mailer: Microsoft
Outlook" or maybe Outlook Express. For example:

X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4920.2300

The scan should be pretty easy to do using the Python email package, but I
don't have a complete archive to scan against.

4. If your address book contains "onehopeministry.com" or some of the other
odd things showing up then you are probably the one infected.

Any other suggestions? Is the list actually configured to not accept posts
accept from subscribers? If not, that should be changed.

ka

> -----Original Message-----
> From: pythonmac-sig-bounces at python.org
> [mailto:pythonmac-sig-bounces at python.org]On Behalf Of Jack Jansen
> Sent: Sunday, June 01, 2003 2:23 PM
> To: pythonmac-sig at python.org
> Subject: [Pythonmac-SIG] Somebody probably has a virus, please check!
>
>
> Folks,
> since a few days I've been getting a flurry of bounce messages for
> viruses that appear to have been sent from "pythonmac-sig at python.org".
> This means there's a good chance that someone on the list has gotten
> infected with a virus that uses their address book to forge From:
> addresses. (There's also a chance that the person infected isn't on
> this list, but happened to have visited the SIG homepage, in which case
> there's nothing we can do).
>
> Can I ask everyone, *especially people who follow the list on a Windows
> machine*, to run their virus-scanner?
> --
> - Jack Jansen        <Jack.Jansen at oratrix.com>
> http://www.cwi.nl/~jack -
> - If I can't dance I don't want to be part of your revolution -- Emma
> Goldman -