On 2/10/02, David Ridgway wrote:

>Hi Ian and Tweeters,
>
>I get the Tweeters digest so I don't get e-mails from individuals.
>My ISP's virus protection got an e-mail using your name but from a
>different address than you usually use.

It's extremely unlikely that this particular worm (probably one of the
klez varients) came from Ian. And it didn't go through the tweeters
list--it came to some tweeters subscribers (anyone who has posted who's
address is still in the mailbox of the infectee) and it probably went
to a lot of other random people too. The modern worms/viruses tell a
lot of lies. You have to examine the full headers, and even then you
can't get farther than maybe being able to figure out which isp the
infected person uses. In this case, it may (or may not) be someone
using a dialup line to use bigzoo.net. The bottommost Received line:

Received: from o8m6v5 (dialup-64.154.190.26.dial1.seattle1.level3.net
[64.154.190.26])
by mail.bigzoo.net (8.11.3/8.11.3) with SMTP id g932nHZ07922;
Wed, 2 Oct 2002 19:49:17 -0700


You can tell that it didn't come through the tweeters list, because
there is no line saying

Sender: TWEETERS-owner at u.washington.edu

(If there is such a line, it doesn't mean that it absolutely came
through the list, that line can itself be forged; but every message
that really does come through the list contains that line.)


>Here is the header:

>Subject: Re: Common Grackle still there

You can't count on the subject line being the same for everyone. the
modern worms can easily create completely different messages for each
new potential victim. They use real subject lines, and real body text,
either from existing mail, or from random files on the computer. They
send to any address they find anywhere on the computer, including
cached web pages. They pretend to be From: any address they find on
the computer. They can contain random real attachments with real file
names as camoflage (these files often contain sensitive data--I once
got someone's excel file checkbook.)

>This is probably a Windows generated virus

Aren't they all? :-) Monocultures breed diseases. Leave the
monoculture, and you'll instantly improve your health and peace of
mind. If for some reason you can't leave the monoculture, at least
keep up to date on your pesticides. Use a good anti-viral program and
keep it updated--at least daily. Keep up to date on the M$ security
patches. Check that daily, too. Then keep all fingers and toes
crossed.
--
Allyn Weaks allyn at tardigrade.net Seattle, WA Sunset zone 5
Pacific NW Native Wildlife Gardening: http://www.tardigrade.org/natives/
"The benefit of even limited monopolies is too doubtful, to be opposed
to that of their general suppression." Thomas Jefferson