S. Ring has badtrans virus

From: Pete Turnbull <pete_at_dunnington.u-net.com>
Date: Wed Nov 28 12:36:45 2001

On Nov 28, 12:38, Douglas Quebbeman wrote:

> > But the way it does it is *very* questionable.. The email is routed to
one
> > of their servers before being routed to you inbox.

No, it just runs another server on your own machine (127.0.0.1, localhost)
and redirects mail to that before giving it to Outlook.

> Network Associates' Groupshield Exchange and Computer Associates'
> eTrust InoculateIT! Exchange Option scan the mail as it comes in
> to the server and what gets put in the inbox has been sanitized...
>
> except, apparantly, the BADTRANS virus. Fortunately, the client-
> side realtime scanner caught it...

Lots of things miss it because it's fairly new. It's only been around a
few days. Most of the anti-virus sites have had updates for couple of days
or more, though.

One of the ways it works is to look through existing mail for messages that
haven't been replied to, and reply to them. That way the recipient not
only gets mail from someone whose address he recognises, it has a sensible
subject line too. That's probably why several list members have it, and
why Sellam got what he did.


-- 
Pete						Peter Turnbull
						Network Manager
						University of York
Received on Wed Nov 28 2001 - 12:36:45 GMT

This archive was generated by hypermail 2.3.0 : Fri Oct 10 2014 - 23:34:12 BST