Re: [9fans] Returned mail: Service unavailable

Re: [9fans] Returned mail: Service unavailable

[okamoto]

> i got tons of the things, but you never open/detache them.
> 
> we need a hunter/killer team.

probably, Scott is in vacation. ☺

Kenji

[9fans] Returned mail: Service unavailable

[Mail Delivery Subsystem]

[-- Attachment #1: Type: text/plain, Size: 1176 bytes --]

The original message was received at Fri, 22 Aug 2003 00:46:20 -0400 (EDT)
from adsl-68-20-119-158.dsl.sfldmi.ameritech.net [68.20.119.158]


*** ATTENTION ***

Your e-mail is being returned to you because there was a problem with its
delivery.  The address which was undeliverable is listed in the section
labeled: "----- The following addresses had permanent fatal errors -----".

The reason your mail is being returned to you is listed in the section
labeled: "----- Transcript of Session Follows -----".

The line beginning with "<<<" describes the specific reason your e-mail could
not be delivered.  The next line contains a second error message which is a
general translation for other e-mail servers.

Please direct further questions regarding this message to your e-mail
administrator.

--AOL Postmaster



   ----- The following addresses had permanent fatal errors -----
<josephrgalvin@aol.com>

   ----- Transcript of session follows -----
... while talking to air-xb01.mail.aol.com.:
>>> DATA
<<< 554 TRANSACTION FAILED - Unrepairable Virus Detected. Your mail has not been sent.
554 <josephrgalvin@aol.com>... Service unavailable

[-- Attachment #2: Type: message/delivery-status, Size: 380 bytes --]

[-- Attachment #3.1: Type: text/plain, Size: 210 bytes --]

The following attachment had content that we can't
prove to be harmless.  To avoid possible automatic
execution, we changed the content headers.
The original header was:

	Content-Type: text/rfc822-headers

[-- Attachment #3.2: file.suspect --]
[-- Type: application/octet-stream, Size: 704 bytes --]

Received: from  TRU-TEMPHVAC (adsl-68-20-119-158.dsl.sfldmi.ameritech.net [68.20.119.158]) by rly-xb03.mx.aol.com (v95.1) with ESMTP id MAILRELAYINXB37-9d3f45a00d1ed; Fri, 22 Aug 2003 00:46:08 -0400
From: <9fans@cse.psu.edu>
To: <JosephRGalvin@aol.com>
Subject: Re: Details
Date: Thu, 21 Aug 2003 12:46:10 --0400
X-MailScanner: Found to be clean
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="_NextPart_000_087D4652"
X-AOL-IP: 68.20.119.158
X-AOL-SCOLL-SCORE: 0:XXX:XX
X-AOL-SCOLL-URL_COUNT: 0
Message-ID: <200308220046.9d3f45a00d1ed@rly-xb03.mx.aol.com>

Re: [9fans] Returned mail: Service unavailable

[lucio]

>>
>>
>>The original message was received at Fri, 22 Aug 2003 00:46:20 -0400 (EDT)
>>from adsl-68-20-119-158.dsl.sfldmi.ameritech.net [68.20.119.158]
>>
> Hey, neat. Someone else from sfldmi.ameritech.net is on 9fans!
>
Doesn't seem like good news to me:

	From: 9fans@cse.psu.edu
	Date: Fri Aug 22 07:26:49 SAT 2003
	To: Maxieakfx@home.se
	Subject: Re: Wicked screensaver

that's a virus!

++L

Re: [9fans] Returned mail: Service unavailable

[lucio]

> Sure, it's a virus. What am I going to do, sulk about it?
> I just found it interesting that someone else from my area
> subscribed to 9fans ;-)

...  and mail to it bounces.  No, you certainly shouldn't sulk about
it, I just thought it was ironic.  The whole issue around this
particular virus is quite confusing anyway.

++L

Re: [9fans] Returned mail: Service unavailable

[boyd, rounin]

i got tons of the things, but you never open/detache them.

we need a hunter/killer team.

Re: [9fans] Returned mail: Service unavailable

[Rob Ristroph]

>>>>> "northern" == northern snowfall <dbailey27@ameritech.net> writes:
northern>
>>
>>
>> Doesn't seem like good news to me:
>>
northern> Sure, it's a virus. What am I going to do, sulk about it?  I
northern> just found it interesting that someone else from my area
northern> subscribed to 9fans ;-)
northern>
northern> Don
northern>
northern> http://www.7f.no-ip.com/~north_

They are not necessarily subscribed; the worm just managed to find
the 9fans address somewhere on the computer, possibly in a cached web
page, so it could put that in the From: part of the emails it sent
out.

--Rob

Re: [9fans] Returned mail: Service unavailable

[boyd, rounin]

Final Solution  -- Pere Ubu

The girls won’t touch me cause I got a misdirection
An living at night isn’t’ helping my complexion
The signs all say it’s a social infection
And a little bit of fun’s never been an insurrection
My mom threw me out till I get some pants that fit
She just won’t approve of my strange kind of wit
I get so excited I always gotta lose it
Then they send me off and make me take the cure
But I don’t need a cure
D-don’t need a cure
D-don’t need a cure
I need a final solution
Buy me a ticket to a sonic reduction
Guitars gonna sound like a nuclear destruction
It’s seems I’m the victim of natural selection
Meet me on the other side--no direction!
Cause I don’t need a cure
D-don’t need a cure
D-don’t need a cure
I need a final solution


http://www.secraterri.com/final.html

Re[2]: [9fans] Returned mail: Service unavailable

[Martin Althoff]

I have been getting loads of those "undeliverables" as well. Really
seems that someone is using 9fans members not only as spam destination
but also as source.

Yesterday I also got swamped with around 20 virus infected mails with
.scr and similar attachments from all kinds of (fake) addresses. I use
Bat! Mail which never executes anything (it can't) and virus scan. So
I am safe, but it gets rather anoying.

Could it not be possible to block a lot more, eg simply prevent
attachments? I know some members, when replying, have the original
message as attachments, but still... 100k of wasted bandwidth with
viruses is unneeded....

Martin


<<<<<================>>>>>

Friday, August 22, 2003, 7:37:59 AM, you wrote:

>>
>>
>>Doesn't seem like good news to me:
>>
> Sure, it's a virus. What am I going to do, sulk about it?
> I just found it interesting that someone else from my area
> subscribed to 9fans ;-)

> Don

> http://www.7f.no-ip.com/~north_

Re: [9fans] Returned mail: Service unavailable

[northern snowfall]

>
>
>The original message was received at Fri, 22 Aug 2003 00:46:20 -0400 (EDT)
>from adsl-68-20-119-158.dsl.sfldmi.ameritech.net [68.20.119.158]
>
Hey, neat. Someone else from sfldmi.ameritech.net is on 9fans!

Don

http://www.7f.no-ip.com/~north_

Re: Re[2]: [9fans] Returned mail: Service unavailable

[lucio]

> vix had it down and we can take these fools out with simple tech solutions.
>
Why can't you be a bit more specific?  You don't know how many here
may be willing to take what sounds like draconian measures.

++L

Re: Re[2]: [9fans] Returned mail: Service unavailable

[lucio]

> vix had it down and we can take these fools out with simple tech solutions.
>
Why can't you be a bit more specific?  You don't know how many here
may be willing to take what sounds like draconian measures.

++L

Re: Re[2]: [9fans] Returned mail: Service unavailable

[boyd, rounin]

no, this is not the final solution.

vix had it down and we can take these fools out with simple tech solutions.

laws are what they do when they can think of nothing better to do.

Re: Re[2]: [9fans] Returned mail: Service unavailable

[lucio]

Oops, sorry about the double post!

++L

Re: [9fans] Returned mail: Service unavailable

[northern snowfall]

>
>
>Doesn't seem like good news to me:
>
Sure, it's a virus. What am I going to do, sulk about it?
I just found it interesting that someone else from my area
subscribed to 9fans ;-)

Don

http://www.7f.no-ip.com/~north_

Re: Re[2]: [9fans] Returned mail: Service unavailable

[lucio]

> i know how to do it, but i have bad carpal tunnel.  anyway, the basic
> idea is to parse the Received: headers and bitch to every site;
> backpressure works.  you could even plumb it out of faces; punch
> the message up and say "kill 'em".
>
That's perfectly reasonable, it's something SPAMCOP (spamcop.org?)
could have thought of.  I haven't used SPAMCOP in a long time, so I
can't recall exactly what they actually do, maybe their approach is as
close to that as needed.  Can't say it's had any effect, but the swell
of indignation is certainly growing.  Perhaps a certain critical
mass needs to be reached first and we may be close to it.

Unfortunately, spoofing Received: headers has long been a weapon in
the hands of spammers, so one has to be prepared to negotiate.  On the
other hand, as mentioned before, SMTP authentication may well become
the norm, in which case the relay agent can be compelled to accept
legal liability for the resources consumed by unsolicited mail.  This
is close in practice to implementing postage stamps at the sender's
expense.

++L

PS: SPAMCOP requires one to confirm, at some bother, all
notifications, which is far too demanding for the average user, hence
a spectacular lack of success.

Re: Re[4]: [9fans] Returned mail: Service unavailable

[lucio]

> ... just a bit more filtering would be nice :))

Thing is, 9fans is gated from Usenet, therefore it's difficult to
restrict posting to the membership.  It is probably possible, but
Scott is not the list server administrator.  I don't think
SpamAssassin can be used as a virus filter, although RAV for Unix
(USD299 :-) seems to work adequately.

++L

Re: Re[2]: [9fans] Returned mail: Service unavailable

[boyd, rounin]

> Why can't you be a bit more specific?  You don't know how many here
> may be willing to take what sounds like draconian measures.

i know how to do it, but i have bad carpal tunnel.  anyway, the basic
idea is to parse the Received: headers and bitch to every site;
backpressure works.  you could even plumb it out of faces; punch
the message up and say "kill 'em".

one shot, one kill.

jesus, have a lot of Yes.

Re: Re[2]: [9fans] Returned mail: Service unavailable

[boyd, rounin]

> > vix had it down and we can take these fools out with simple tech solutions.
> >
> Why can't you be a bit more specific?

he was using EBGP, but that's not really a solution.

inventive, yes.

seems i have the little known Midnight Oil _Species Deceases_.

Re[4]: [9fans] Returned mail: Service unavailable

[Martin Althoff]

> Why can't you be a bit more specific?  You don't know how many here
> may be willing to take what sounds like draconian measures.

... just a bit more filtering would be nice :))
Martin

Re: [9fans] Returned mail: Service unavailable

[northern snowfall]

>
>
>They are not necessarily subscribed; the worm just managed to find
>the 9fans address somewhere on the computer, possibly in a cached web
>page, so it could put that in the From: part of the emails it sent
>out.
>
Uh oh, I didn't know this about the worms....
In that case, it might be friends of mine...

Don

http://www.7f.no-ip.com/~north_

Re: Re[2]: [9fans] Returned mail: Service unavailable

[boyd, rounin]

the final solution is to either beef up IP  (bad idea) or replace
it with a mutually authenticaticated , encrypted protocol.

maybe i'll just stick to shooting 9mm 'cos that is a lot easier
on the carpal tunnel (as long as you fire single action).

now, no lectures on safety.  i did it a week ago -- no problem.