Martin Pool's blog

Mail me RSS Bazaar distcc Canonical is hiring! flickr

Brownlist

I'd like to see an IP blacklist of machines with stupid antivirus software that replies to viruses with forged From addresses. I propose to call this a babypoobrownlist. Sadly it seems even RAV Antivirus can be configured to be this stupid:

From: RAV AntiVirus <ravms@mail1.utlonline.co.ug>
Subject: RAV AntiVirus scan results
Date: Mon, 26 Apr 2004 16:28:57 +0300
To: aicmbarara@utlonline.co.ug
[50 addresses deleted]

This e-mail is generated by the mail1.utlonline.co.ug mail server to warn you that the e-mail sent by aicmbarara@utlonline.co.ug to robert@aquabotanic.com, paulio629@aol.com, not@thisaddress.com, tommyboy@hotmail.com, news@ftscotland.co.uk, ifraigun@aol.com, steve@tropheus.demon.co.uk, 47@msn.com, c.durand@comcast.net, fornguse@shaw.ca, campaigns@votenader.org, indigomoon@bonbon.net, n.sandberg@comcast.net, thomaswinters@cablespeed.com, bleahcim49@frontiernet.net, the-big-dog@comcast.net,

If you are the sender:
-------------------

The scanned e-mail has your address in the header field. Either your computer is infected or someone's computer having your e-mail address in the address book has been infected.

(Please note that some viruses are sending e-mails directly from your computer. Our advise is to check your computer using an up-to-date antivirus product).

If you are the receiver:
---------------------

Please contact the sender: most likely he/she doesn't know he/she has a computer virus.

I mean really, what incredibly moronic advice. What am I supposed to do about some random person who has me in their address book? The last thing I want is email from some benighted windows user telling me I have a computer virus.

posted Tue 27 Apr 2004 in /issues/virus | link

requires approval

Date: Wed, 11 Feb 2004 20:20:16 +0000
To: distcc-owner
Subject: distcc post from postmaster@solucorp.qc.ca requires approval

Oh, no it doesn't. It requires a great big lart:

Our virus detector has just been triggered by a message you sent:-
To: jack@localhost
Subject: Helol
Date: Wed Feb 11 15:19:29 2004

posted Fri 20 Feb 2004 in /issues/virus | link

Norton AntiVirus considered harmful

Return-Path:
X-Original-To: distcc@lists..org
From: Norton AV
To: "'distcc@lists.samba.org'"
Subject: Norton AntiVirus detected and quarantined a virus in a message yo u sent.
Date: Sat, 31 Jan 2004 17:04:47 -0500
Subject of the message: Mail Delivery System
One or more attachments were quarantined.
Attachment readme.zip was Quarantined for the following reasons:
Virus W32.Novarg.A@mm was found.
Virus W32.Novarg.A@mm was found in readme.pif.

If it's too stupid to understand that Novarg always forges sender addresses, how can it possibly offer any protection? Who would pay money for such braindead software?

posted Tue 3 Feb 2004 in /issues/virus | link

Copyright (C) 1999-2007 Martin Pool.