At 06:02 PM 8/21/2003, Margie wrote:
--On Thursday, August 21, 2003 5:37 PM -0400 Yakov Shafranovich <research@solidmatrix.com> wrote:Thank you for the correction.
Not really. It indicates that there is a *possibility* that someone on the list is infected.Just to follow up - I have been getting copies of the virus with the asrg@ietf.org return address. This indicates that someone on the list IS INFECTED.
Then again it could be someone that visited the web archive, or google, or the ietf site or slashdot, or some other website with that address on it, or reads comp.mail.sendmail, or nanae, or spam-l, or had someone forward a post to them. The worm scrapes anything that looks like an email address from a variety of file types, including .eml, .html, .htm, .txt .....
We're getting them sent to weird reference numbers that go out in the body of mail.