Re-Bitten Hero

I've just received an e-mail from one "_Philip.Beckwith1@ntlworld.com" which has a virus in it [img]images/smilies/mad.gif[/img]

If anyone knows who this is, please let him know!

It was sent to my Scoobynet address, so be warned - do not open any e-mail from "philip.beckwith1" - just delete it immediately!

Thank you Norton Antivirus...

Cheers
Richard

Neil Smalley

If it's the Klez virus he might not have it at all!

Klez forges the From: line to another email adresses in the address book.

Having an up to date, decent virus checker is essential these days

Re-Bitten Hero

It was the W32.Badtrans@mm.enc virus... and his e-mail address bounces (with the _ at the start - have sent one to the same address without the _ to see if it works )

Richard

carl

That's salsa-king

DJ Dunk

iTrader: (5)

I always delete mail from Phil without reading it anyway

Just kidding

JackClark

Group buy on Antivirus anyone?

Re-Bitten Hero

Poor Phil I've e-mailed him on his other e-mail address to let him know...

Richard

ChrisB

LOL @ Jack

Josh L

The current viruses that are doing the rounds, are very clever little beasts. I've been emailing Phil all morning, and his replies have been perfectly safe.

I've had two viruses from ScoobySport, amongst many, many others, only to find that that it isn't from them at all. They do give themselves away with a few mistakes. In my case, it was the receipt of an email from postmaster@apexphoto, which doesn't exist. Obviously they try to get round networked systems by trying to masquerade as the system.

I've even received a couple of emails from people informing me that my email has been bounced as it contained a virus. Only problem is I don't know who the hell these people are.

Thank God for Norton.

Josh

carl

Just bust the rules, why don't you? If you accept mail into a domain, you are required to accept mail to postmaster@ that domain

dsmith

Just because Josh doesnt havent an account setup to send mail "from" postmaster doesn't necessariuly mean mail is not accepted "for" postmaster.

All unknown names for my domain e.g. postmaster,root,hairybollox etc are simply forwarded to the "main" account. thus not blocked - and yet I dont have client software set up to send "from" all of those names.

gossythevaleter

Phil beckwith is salsa king he is aware of the problem and apologises he does not know where he got it from but it has already gone through his address book

salsa-king

sorry peeps

all sorted now thanks to SJSkyline!! Richard!

i ONLY use TALK21.com to Email ppl!
this was coming to you from a NTL account i have...but don't use!


it may have come on my computer from a RETURNED MAIL!!! (i've heard)


DELETE ANY PHILIP.BECKWITH1 NTL account Emails from me!

Thanks every one

Phil

Re-Bitten Hero

No problem Phil, glad it's under control... %^$£&£*$ viruses [img]images/smilies/mad.gif[/img] Unlucky it picked you

Cheers mate
Richard

NotoriousREV

No you're not, it's just best practice to provide a postmaster address for complaints from other admins. There is no controlling body on the internet, therefore the are no requirements on what addresses you can or can not set up.

logiclee

Been getting these from my Father in Law's ntl pop3 account all week, he's on holiday and his computers turned off? Spoke to him and thats the only pc with his account set up Very clever this latest one.

Also recently had Clean (ooher ) emails from Phil.

Lee

NotoriousREV

Do you know how many ISP's stick rigidly to RFC822? Not one of them

RFC822 is merely a set of guidelines, all are best practises not legal (or otherwise) requirements.

carl

Yes, and not sticking to the RFCs (particularly when developing network hardware) never causes problems, does it
L2TP anyone?

ian_sadler

The virus is prob. a mutation caused by excess exposure to silly lights under car bodies.

Ian

SJ_Skyline

Salsa had a copy of W32/BadTrans-B. - All clear now (Fingers crossed!!)


If you think you have contacted this, removal instructions are available here:

http://vil.mcafee.com/dispVirus.asp?virus_k=99069

Rich

salsa-king

thanks for your help Richard

Phil

Re-Bitten Hero

Yep, thanks SJ Richard

Cheers
Richard

JackClark

Phil, In the interest of my human behaviour study can you tell me what you clicked on?

The message attachment name will be one of the following:

Card.DOC.pif
docs.DOC.pif
fun.MP3.pif
HAMSTER.DOC.pif
Humor.MP3.scr
images.DOC.pif
info.DOC.scr
Me_nude.MP3.scr
New_Napster_Site.MP3.pif
news_doc.DOC.scr
Pics.DOC.scr
README.MP3.scr
S3MSONG.DOC.scr
SEARCHURL.MP3.pif
SETUP.DOC.scr
Sorry_about_yesterday.MP3.pif
stuff.MP3.pif
YOU_are_FAT!.MP3.scr

carl

You're right, there is no controlling body (apart from your ISP), but it's a requirement of RFC822:

6.3. RESERVED ADDRESS

It often is necessary to send mail to a site, without knowing any of its valid addresses. For example, there may be mail system dysfunctions, or a user may wish to find out a person's correct address, at that site.

This standard specifies a single, reserved mailbox address (local-part) which is to be valid at each site. Mail sent to that address is to be routed to a person responsible for the site's mail system or to a person with responsibility for general site operation. The name of the reserved local-part address is:
Postmaster

so that "Postmaster@domain" is required to be valid.

Note: This reserved local-part must be matched without sensitivity to alphabetic case, so that "POSTMASTER", "postmaster", and even "poStmASteR" is to be accepted.

[Edited to say: it's a bit academic, as dsmith addressed the (non-) issue ]

[Edited by carl - 7/9/2002 3:51:48 PM]

fuz

Sj saves the day

Autocar

Mmmmm last year......

IWatkins

Damn, I read through the thread thinking "My, this thread rings bells, I'm sure salsa-king had a virus like this last year".

Then I got to the end and saw the dates, doh !

Still LOL at Jack's comment

Cheers

Ian

SJ_Skyline

fuz you bl00dy muppet!