[ADMIN] It lives!

[Orin]

> Hi Orin:  It seems as if that virus email was specifically targeted against
> this list.

I don't think so.

> Who did it come from?

Looking at the headers...

>From diy_efi-owner  Thu Dec 28 16:29:39 2000
Return-Path: <owner-diy_efi at lists.diy-efi.org>
Received: (from majordom at localhost)
	by hektor.valesh.com (8.9.3/8.9.3/Debian 8.9.3-21) id QAA30548
	for diy_efi-outgoing; Thu, 28 Dec 2000 16:29:39 -0800
Received: from mtiwmhc22.worldnet.att.net (mtiwmhc22.worldnet.att.net [204.127.131.47])
	by hektor.valesh.com (8.9.3/8.9.3/Debian 8.9.3-21) with ESMTP id QAA30544
	for <diy_efi at diy-efi.org>; Thu, 28 Dec 2000 16:29:33 -0800

We received it from mtiwmhc22.worldnet.att.net.  This header came
from our sendmail, so we can believe it.

Received: from default ([12.77.138.85]) by mtiwmhc22.worldnet.att.net
          (InterMail vM.4.01.03.10 201-229-121-110) with SMTP
          id <20001229002837.ZYKG2072.mtiwmhc22.worldnet.att.net at default>
          for <diy_efi at diy-efi.org>; Fri, 29 Dec 2000 00:28:37 +0000

We can probably believe this one too.  Doing nslookup on 12.77.138.85
gives:  85.tampa-16-17rs16rt.fl.dial-access.att.net
So, my guess is someone in Tampa, FL is infected and they
were online around 7:28 PM local time...

From: Hahaha <hahaha at sexyfun.net>
Subject: Snowhite and the Seven Dwarfs - The REAL story!

These are typical for the virus and are mentioned in the
article about it.  So, directed as it may seem, it
appears to be a coincidence to me...  unless someone
deliberately infected themselves and let it run.

Orin.

----------------------------------------------------------------------------
To unsubscribe from diy_efi, send "unsubscribe diy_efi" (without the quotes)
in the body of a message (not the subject) to majordomo at lists.diy-efi.org