Subject: rse has beagle-a virus ?

From: "madhon" <[email-masked]>
Date: Fri, 27 Feb 2004 23:30:43 -0000

just had a couple of copies of this come through from rse@Engelschall ...
someone needs to check their machine

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Dave Paris" <[email-masked]>
Date: Fri, 27 Feb 2004 18:50:39 -0500

More likely a faked 'From' address.  While possible, it's highly improbable
that the source is actually Ralf's machine.  I've routed my copies to
/dev/null so I can't examine the headers to determine if the source address
actually resides in Europe or not.

Kind Regards,
-dsp

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of madhon
> Sent: Friday, February 27, 2004 6:31 PM
> To: [email-masked]
> Subject: rse has beagle-a virus ?
>
>

---

From: "A.T.Z." <[email-masked]>
Date: Sat, 28 Feb 2004 07:57:12 +0100

>actually resides in Europe or not.

Here you have a few of them. Nothing goes to /dev/null here without me 
looking at it first :)

Those were send to this list:

Received: from cruzeiro (cruzeiro.fisc.wwu.edu [140.160.220.200])
by master.modssl.org (Postfix) with SMTP id 8EBC7A8934

Received: from CLS-TORG1010-24 (torg1010-24.its.vt.edu [128.173.44.188])
by master.modssl.org (Postfix) with SMTP id 245B5A8934

Received: from AdamBroughton (asdl00.ae.gatech.edu [130.207.39.100])
by master.modssl.org (Postfix) with SMTP id 96173A8934

Received: from woofie (A052105.N1.Vanderbilt.Edu [129.59.52.105])
by master.modssl.org (Postfix) with SMTP id 37622A8934

Received: from CLS-TORG1010-30 (torg1010-30.its.vt.edu [128.173.44.194])
by master.modssl.org (Postfix) with SMTP id 7A3C1A8941

Anyone seeing their own IP should at least go to an online scanner like 
http://housecall.trendmicro.com or http://www.symantec.com

Have fun with them..

B.

---

From: Dave Paris <[email-masked]>
Date: Sat, 28 Feb 2004 07:24:43 -0500

As I suspected, none of these messages originate from Ralf.  Just 
checking the original headers on the most recent batch of six I got 
overnight...

from cruzeiro (cruzeiro.fisc.wwu.edu [140.160.220.200])	by master.modssl.org
from CLS-TORG1010-27 (torg1010-27.its.vt.edu [128.173.44.191])	by 
master.modssl.org
from CLS-TORG1010-24 (torg1010-24.its.vt.edu [128.173.44.188])	by 
master.modssl.org
from CLS-TORG1010-30 (torg1010-30.its.vt.edu [128.173.44.194])	by 
master.modssl.org
from woofie (A052105.N1.Vanderbilt.Edu [129.59.52.105])	by master.modssl.org
from AdamBroughton (asdl00.ae.gatech.edu [130.207.39.100])	by 
master.modssl.org

What this tells me is that someone realized the .edu addresses on the 
listserv were low hanging fruit.  Nice job.  Try partying less, studying 
more, and figure out how to keep yourself from being infected (on 
multiple fronts).  [aside:  pisses me off that I have to deal with spam 
from cracked/infected boxes from .edu domains ... I think I'm just going 
to reject all .edu-headered mail.  it's a hugely sad commentary that 
people from institutions of *higher* education can't grasp the concept 
of DON'T CLICK ON F^&KING ATTACHMENTS YOU'RE NOT EXPECING and USE A 
F#@KING A/V PACKAGE ALREADY, DAMNIT.  I mean really, people.. you're 
shelling out a TON of money and you don't seem to be one lick smarter 
than Jimmy Joe-Jobber's mom who'll click on everything and anything 
since getting her PC two weeks ago.  If you're as f%$king stupid as you 
appear to be, give it up .. save yourself the money and give your slot 
at school to someone else.  There no shame in doing manual labor for a 
living.  Society needs both ends of the spectrum.  If you can't figure 
out the "don't click" stuff, I have no idea what you're going to do with 
number theory or algorithms (assuming you're in a CS program).  I vote 
to kick the .edu's off the listserv until they prove they've got an 
intellectual agility quotient above that of a small soapdish.  If this 
pisses off admins for .edu's, sorry .. life's a bitch, grab a helmet. 
The rest of us out in the real world have to deal with [l]users like 
this and keep our networks clean for the rest of the planet - you're no 
different... you just have a harder job that I certainly don't envy. 
Perhaps instituting a "three strikes" policy for students .. the first 
infection gets you a warning .. the second gets you booted off the 
school's network .. the third (meaning you violated both the 2nd AND 
1st) gets you booted from school.  Hrmm.. not a bad idea, I suppose. 
Anyway .. rant mode is now OFF.]

Kind-ish Regards,
-dsp :-)
[...]

---

From: Joachim Feise <[email-masked]>
Date: Tue, 02 Mar 2004 12:42:07 -0800

Dave Paris wrote on 2/28/2004 4:24:
> I vote

Now, there are .edu admins who actually know what they are doing.
Here our admins actively scan machines, and isolate infected ones from
the Net.

The last ones came from Lucent, anyway:
Received: from auemail2.firewall.lucent.com (auemail2.lucent.com [192.11.223.163])
	by master.modssl.org (Postfix) with ESMTP id E05B4A8A6F
	for <[email-masked]>; Tue,  2 Mar 2004 09:33:45 +0100 (CET)
Received: from cinjjtu (h135-252-58-142.lucent.com [135.252.58.142])
	by auemail2.firewall.lucent.com (Switch-2.2.8/Switch-2.2.8) with SMTP id
i228Xe327008
	for <[email-masked]>; Tue, 2 Mar 2004 02:33:40 -0600 (CST)

so the "real world" can't keep their machines clean, either...

-Joe