Subject: grow: Temporary suspension

From: "Lucy E. Lynch" <[email-masked]>
Date: Tue, 17 Jan 2006 09:27:07 -0800 (PST)

All -

I've disabled posting for [email-masked] until the virus thing
clears.

Lucy E. Lynch 				Academic User Services
Computing Center			University of Oregon
llynch  @darkwing.uoregon.edu		(541) 346-1774
_________________________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/grow.html
web archive:        http://darkwing.uoregon.edu/~llynch/grow/

---

From: Gunnar Lindberg <[email-masked]>
Date: Wed, 18 Jan 2006 09:49:01 +0100 (MET)

This shouldn't be on the list but neither <[email-masked]>
nor <[email-masked]> has responded, so:

    My 0.01c is to add virus scan of incomming messages to the list
    server and quarantine (or drop) those that seem/are infected.
    Blocking offending From addresses opens for an interesting DoS.

    Depending on who you ask, the recent virus storm was

	Sohpos      W32/Nyxem-D      (tested)
	f-prot      W32/Kapser.A@mm  (tested)
	McAffee     W32/MyWife.d@MM  (searched alias)
	CA          Win32/Blackmal.F (searched alias)

	    Gunnar Lindberg

PS
    If anyone want to go virus hunting, here are IP and Received
    line time stamps (as set by mailapps.uoregon.edu)

    [64.60.110.251]; Mon, 16 Jan 2006 14:24:20 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 14:43:56 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 14:47:55 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 14:58:42 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 15:13:20 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 15:23:41 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 15:32:24 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 15:47:37 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 16:07:23 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 16:25:23 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 16:32:36 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 16:43:52 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 16:47:25 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 16:58:41 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 17:10:18 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 17:24:16 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 17:41:12 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 17:44:39 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 17:57:16 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 18:13:23 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 18:26:12 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 18:29:58 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 18:53:23 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 19:09:19 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 19:27:44 -0800
    [64.60.110.251]; Mon, 16 Jan 2006 19:53:49 -0800
    [213.26.166.74]; Mon, 16 Jan 2006 22:56:43 -0800
    [213.26.166.74]; Mon, 16 Jan 2006 23:19:06 -0800
    [213.26.166.74]; Mon, 16 Jan 2006 23:40:23 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 00:03:32 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 00:23:39 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 00:44:33 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 01:05:20 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 01:25:25 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 01:48:42 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 02:10:11 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 02:52:34 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 03:16:51 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 04:05:30 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 04:33:57 -0800
    [213.26.166.74]; Tue, 17 Jan 2006 05:15:49 -0800
    [59.144.1.43]; Tue, 17 Jan 2006 05:51:11 -0800
    [59.144.1.43]; Tue, 17 Jan 2006 07:30:09 -0800
    [59.144.1.43]; Tue, 17 Jan 2006 09:06:13 -0800
								    DS

>From [email-masked]  Tue Jan 17 18:29:50 2006
>Date: Tue, 17 Jan 2006 09:27:07 -0800 (PST)
>From: "Lucy E. Lynch" <[email-masked]>
>To: [email-masked]
>Subject: grow: Temporary suspension
>Message-ID: <[email-masked]>

---

From: "Lucy E. Lynch" <[email-masked]>
Date: Wed, 18 Jan 2006 09:10:57 -0800 (PST)

> nor <[email-masked]> has responded, so:

I saw no message from you sent to [email-masked]

> 	CA          Win32/Blackmal.F (searched alias)

I added filtering based on extensions to the majordomo config when I
disabled the [email-masked] address. We also run clamAV/Fresh Clam on
the mailapps box, so this should clear fairly quickly. Chasing ips is
not worth the time and effort, so I went with a temp suspension until
other measures kicked in.

- lel