Star Wars

Kathryn's a true IFIS member. Sat down in front of Star Wars on ITV,
fascinated by R2 and the sand people.

---

Nick Waterman, IFIS Information Superhypewayman
nick-sig@ www.ifis.org.uk/ http://noseynick.org/
We're the weirdest monkeys ever. -- Karl Lehenbauer

<sniff> I could cry..... I bet you're so proud.

Now lets see what she makes of the new series of the LoG on September 26th ;-)

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Philip Ayres
philip_ayres@
NOTE CHANGE OF EMAIL ADDRESS - PLEASE UPDATE YOUR ADDRESS BOOK
www.netcomuk.co.uk/~payres
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

I just got hit by Worm Klez.E immunity virus, do not know what list it came
from (second virus that has hit so far) my Norton discovered it as I was
downloading my mail so it got cleaned before being downloaded. (Something
about claiming to be anti virus program attachment). My system is fine (just
ran a full Norton Virus check to be sure).
Don't know if it was sent via this list but thought best to alert in case.

Roy...

roy blewitt wrote:
[snip]
Klez fakes it's from-address on it's outbound mails, so even if your
antivirus software hadn't deleted it, it would be a pain in the #### to
find out where it actually came from.

It didn't come via this list though.

... but even if it had done, the IFIS lists fairly deliberately strip
out all sorts of MIME headers and ruin attachments, including the ones
used by email viri... PLUS the IFIS lists only allow known list members
email addresses to post, so klez would have to be lucky enough to pick
an IFIS member as it's fake "from".

---

Nick Waterman, IFIS Information Superhypewayman
nick-sig@ www.ifis.org.uk/ http://noseynick.org/
Women's Movement Called More Broad-Based

I've had some experience with this pretty unpleasant little ****er. I used the
File, properties dialog in outlook to have a look at the delivery info without
opening the mail and discovered that there was a return address set on the last
bunch of infected mails I got which was the address of the person who sent it to
me....

Incidentally File, Properties, Details, Message Source seems to give you the raw
contents of an email prior to any UU or MIME decoding etc so you can view any
suspicious documents without opening them and running embedded attachments.....
Quite useful..... But no replacement for a decent virus checker (which you
have) But I digress somewhat ....

This particular thing is a nasty so and so, surprised it's still going, been
round a long time.... papers make a fuss about all these viri that come as
attachments you launch yet not a dickie bird about nasty embedded html stuff
that runs when you open an email.....

And while we're all here - present plans call for me to be in the house Thursday
19th ! Anyone about ?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Philip Ayres
philip_ayres@
NOTE CHANGE OF EMAIL ADDRESS - PLEASE UPDATE YOUR ADDRESS BOOK
www.netcomuk.co.uk/~payres
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Pretty sure that's faked too. "Received" headers may give a clue about the
ISP of the user, but "from", return-path / envelope-from, and "to" are all
chosen randomly out of it's list of collected addresses.

---

Nick Waterman. Senior Blackberry Unix Systems Administrator,
Research In Motion http://www.rim.net/ #include <stddisclaimer>
Sent from my Blackberry Wireless Handheld!

Hmm. The most recent outbreak that assaulted me all came from one friend's
machine, and I'd worked out who it was from the email addresses it was being
faked from before I spotted the reply to path.....

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Philip Ayres
philip_ayres@
NOTE CHANGE OF EMAIL ADDRESS - PLEASE UPDATE YOUR ADDRESS BOOK
www.netcomuk.co.uk/~payres
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Sometimes you'll be able to make a damned good guess, because it uses the
victim's address book, mailboxes, and collects addresses from a few other
places, and uses them for each random "to", faked from, faked return-path,
etc. Thus if you received an email pretending to be from "Paul Waterman" to
"Phil Ayres" with a faked from of "Ali Waterman", then you could make a fair
guess that I'd foolishly installed windows, foolishly decided to run
outlook/oe, foolishly not been running a virus checker, and it was me who
sent you the virus...

... Yeeeeeeah, right, bad example. :-)

---

Nick Waterman. Senior Blackberry Unix Systems Administrator,
Research In Motion http://www.rim.net/ #include <stddisclaimer>
Sent from my Blackberry Wireless Handheld!

Wow!
Of course, I must admit, it is completely true, but how did you know?
You don't have secret hidden cameras trained on me (big brother stylee) do
you?
Or...are you perchance referring to some other humanoid who has the temerity
to use MY name?;-)
Kathryn.

-----Original Message-----
From: Nick - IFIS Information Superhypewayman
To: chat@
Sent: 10/09/2002 20:32
Subject: Star Wars


Kathryn's a true IFIS member. Sat down in front of Star Wars on ITV,
fascinated by R2 and the sand people.

---

Nick Waterman, IFIS Information Superhypewayman
nick-sig@ www.ifis.org.uk/ http://noseynick.org/
We're the weirdest monkeys ever. -- Karl Lehenbauer

Dowd KM wrote:
I was, of course, referring to my 19-month-old daughter, who's been an
IFIS member since long before she was born - remember an
award/certificate for "IFIS Bump" at an xmas dinner nearly 2 years ago?
And "Official IFIS Object of Infinite Affection" shortly after she was
born? :-)

---

"Nosey" Nick Waterman, Senior Sysadmin. #include <stddisclaimer>
sig@ http://noseynick.net/
And the gap, which was just under five seconds, is now just over four.

Nick Waterman wrote:
In fact:
www.ifis.org.uk/social/people/kathryn.shtml
:-p

---

"Nosey" Nick Waterman, Senior Sysadmin. #include <stddisclaimer>
sig@ http://noseynick.net/
And the gap, which was just under five seconds, is now just over four.

Yeah, I did actually remember that after several seconds staring at the
computer screen and going "what!?". It just seemed pretty funny from my end
of the net connection.
Kathryn.

-----Original Message-----
From: Nick Waterman
To: chat@
Sent: 13/09/2002 21:30
Subject: Re: Star Wars

Dowd KM wrote:
stylee) do
temerity
I was, of course, referring to my 19-month-old daughter, who's been an
IFIS member since long before she was born - remember an
award/certificate for "IFIS Bump" at an xmas dinner nearly 2 years ago?
And "Official IFIS Object of Infinite Affection" shortly after she was
born? :-)

---

"Nosey" Nick Waterman, Senior Sysadmin. #include <stddisclaimer>
sig@ http://noseynick.net/
And the gap, which was just under five seconds, is now just over four.