ANSTHRLD - Virus from Who?....Virus from ME

[Nordsteorra]

Hi, all.

Snow White and her 7 STINKING Dwarves are dead...praise be to Norton.

By the way, I tried McAfee VirusScan...it could identify the bug but
couldn't fix it.

I'm also impressed with the local computer store...they let me trade the
McAfee for Norton...even opened.

Regards,
"virus-free" Tadhg...for now

-----Original Message-----
From: owner-heralds at ansteorra.org [mailto:owner-heralds at ansteorra.org]On
Behalf Of Timothy A. McDaniel
Sent: Monday, March 26, 2001 9:41 PM
To: heralds at ansteorra.org
Subject: Re: ANSTHRLD - Virus from Who?


Etienne:
> Daniel:
>>I've never been able to figure out how to tell who sent the "Snow
>>White" virus.  How?
>
> Daniel, you have to look at the full header info of the email.

I did.  Repeatedly.  I didn't see "who", and someone (Magnus, was it?)
said he knew how to tell.

> there is an originating IP line.  This is the actual mail server
> that the virus forwarded through.  As you are aware, the virus
> changes the sent from address to "hahaha at sexyfun.net" so the
> excerpted info will not give enough info.

Hence my question; that is not "who", but "where".  At least one
person who uses swbell.com has been infected, because I've gotten
multiple "Snow Whites" from there, but I don't know if it's one or
many, much less who.

Magnus, I think it was, told me in later e-mail that "Snow White"
sends out a new copy every time the infected user sends e-mail, so if
you happen to get a copy of SW just after someone sends you e-mail
from the same site, it's likely that they're the one responsible.
I haven't checked to see if that's true; I don't think I've gotten a
copy since he told me.

Daniel de Lincolia
--
Tim McDaniel is tmcd at jump.net; if that fail,
    tmcd at us.ibm.com is my work account.
"To join the Clueless Club, send a followup to this message quoting
everything
up to and including this sig!" -- Jukka.Korpela at hut.fi (Jukka Korpela)
============================================================================
Go to http://lists.ansteorra.org/lists.html to perform mailing list tasks.

============================================================================
Go to http://lists.ansteorra.org/lists.html to perform mailing list tasks.