Am 02. Dec, 2004 schwätzte Eric "Shubes" so:

> der.hans wrote:
> > moin, moin,
> >
> > if you have been using 68.98.98.125 today ( 01Dez2004 ), you might want to
> > check for viruses on your local network...
> >
> > $ host 68.98.98.125
> > Name: ip68-98-98-125.ph.ph.cox.net
> > Address: 68.98.98.125
> >
> > ciao,
> >
> > der.hans
>
> Ok, mystery man. ;)
> Why would that be?

That would be because I got junk claiming to be from someone else on the
list and the IP above is the one that gave it to me. Guess it could also
be an open relay, but since it chose two addresses from the list I
presumed it likely to be a virus that searches the hard drive for
addresses to use when sending virus email.

That would also explain the bounces from PLUG-announce to PLUG-discuss
that were discussed yesterday.

> This is, after all, a Linux list...

I've noticed ;-).

> Care to share?
>
> P.S. What about non cox?

Oh, I get lots of SPAM from those as well, but this one looks like it's
someone who has at some time been on the discuss list, so I thought I'd
see if I was correct :).

BTW, if you are indeed on the list. Don't worry about getting roasted, I
would just like to see the problem fixed. I generally presume that any m$
box that's been on a network for more than 5 minutes has been compromised.
Most probably have faster than that, but I want to give some benefit of
the doubt ;-).

Feel free to contact me off-list if you need help cleaning up an m$ box. I
can point you at people who can help. I know only one way and that's by
installing debian :).

ciao,

der.hans
-- 
#  https://www.LuftHans.com/    http://www.AZOTO.org/
#  Magic is science unexplained. - der.hans
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change  you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss