[Mailman-Users] Re: Virus Just Got Through on TOTALLY MODERATED list.

[Brad Knowles]

At 1:49 AM -0500 2005-02-04, Dan Mahoney, System Admin wrote:

>  I checked the vette log.  The message isn't even in there.  Some of the
>  auto-replies to it are (i.e. "message rejected, it's a virus").  And
>  the message shows in the pipermail archives.

	In that case, are you sure that the message passed through your 
system?  Maybe the virus spoofed more than just your moderators 
address....

>  Here's the full headers of the thing:
>
>  Return-Path: <vgc-announce-bounces+varoots=gushi.org at vagrassroots.org>
>  Received: from prime.gushi.org (localhost [IPv6:::1])
>      by prime.gushi.org (8.13.1/8.13.1) with ESMTP id j0S2GH5b080701
>      for <varoots at gushi.org>; Thu, 27 Jan 2005 22:50:56 -0500 (EST)
>  Received: from ROBERTA.net (pcp08579508pcs.alxndr01.va.comcast.net
>      [68.83.208.54])
>      by prime.gushi.org (8.13.1/8.13.1) with SMTP id j0S2FV8o080233
>      for <vgc-announce at vagrassroots.org>;
>      Thu, 27 Jan 2005 21:15:35 -0500 (EST)

	I only see two Received: headers here.  This is not nearly 
enough.  There's a lot of data that appears to be missing.

-- 
Brad Knowles, <brad at stop.mail-abuse.org>

"Those who would give up essential Liberty, to purchase a little
temporary Safety, deserve neither Liberty nor Safety."

     -- Benjamin Franklin (1706-1790), reply of the Pennsylvania
     Assembly to the Governor, November 11, 1755

   SAGE member since 1995.  See <http://www.sage.org/> for more info.