Beware Lovegate virus WAS: Re: what's up with the virus-likeposting to lists?

[Rex Brooks <rexb@starbourne.com>]

James, List members, Karl,

I got em too. And several more. However, they don't come from me. I 
get my mail on a Mac and I have run a virus scan recently which 
detected no new infections. I am running it again, just to be safer. 
These new viruses are most likely the Lovegate virus:

http://internetweek.com/security02/showArticle.jhtml?articleID=20800229

and probably come from the inbox or addressbook of an infected 
machine. Since these come from replies to messages so old that one is 
addressed from [humanmarkup-comment], it is likely from a machine 
which received such emails and have never deleted them, nor replied 
to them, since that is the mechanism of this virus. I don't have any 
unread email messages from that old humanmakrup-comment list which 
OASIS discontinued last year.

I am copying Karl, just so he knows. I don't keep these, but because 
I also received an ANTIGEN message from LA County Sheriff's Dept, and 
I know who that lurker is, I am keeping that one quarantied and 
isolated and I am going to write to him to see if we can back trace 
this particular little monster.

However, the modus operandi of this little basturd is that it replies 
to unread mail in an infected machine, AND it hijacks address lists 
and spoofs those as senders. So it is using two techniques, spoofing 
and mass mailing and that makes it harder to fight.

Ciao,
Rex

>got two emails from you, 1 to humanmarkup.org and 1 to huml,  with 
>weirdly named jpegs and zip file and password in body of email.  you 
>might run stinger on your computers to see if it is a virus
>
>--
>From the desk of James [Jim] E. Landrum III
>Archaeology Materials and Database Manager, Archaeology Technologies 
>Laboratory (ATL),
>North Dakota State University (NDSU).
>Ph. 701-231-7115  FAX: 701-231-1047
>Email: james.landrum@ndsu.nodak.edu
>ATL Web Site: http://atl.ndsu.edu
>Digital Archive Network for Anthropology and World Heritage (DANA-WH)
>DANA-WH Web Site: http://www.dana-wh.net


-- 
Rex Brooks
GeoAddress: 1361-A Addison, Berkeley, CA, 94702 USA, Earth
W3Address: http://www.starbourne.com
Email: rexb@starbourne.com
Tel: 510-849-2309
Fax: By Request