Message-ID: <3F708DE7.9060100@tomt.net>
Date: Tue, 23 Sep 2003 20:16:07 +0200
From: Andre Tomt <andre@tomt.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030901 Thunderbird/0.2
MIME-Version: 1.0
To: linux-kernel@vger.kernel.org
CC: joe briggs <jbriggs@briggsmedia.com>,
       Justin Piszcz <jpiszcz@lucidpixels.com>
Subject: Re: Spam/LKML
References: <Pine.LNX.4.58.0309231318450.11291@p500> <200309231437.43542.jbriggs@briggsmedia.com>
In-Reply-To: <200309231437.43542.jbriggs@briggsmedia.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1209
Lines: 32

joe briggs wrote:
> I am getting hammered with them, though I use a sendmail server.  Is this a 
> manifestation or exploit of the buffer-overflow security issue out with 
> sendmail?

It's just a Microsoft virus names Gibe-F/Swen/Automat.AHB that has 
started spreading this past week or so. Same old, stupid users execute 
an attachment or whatever that scans for email-addresses and spreads 
through them.

The antivirus software on a mailserver I run has picked up 39567 of 
Gibe-F the past 24 hours.

Quoting Sophos (.com):
"W32/Gibe-F is a worm which spreads by emailing itself via its own SMTP 
engine to addresses extracted from various sources on the victim's 
drives (e.g. MBX and DBX files). The worm also spreads using the KaZaA 
peer-to-peer shared folders, via IRC channels and will copy itself to 
the Startup folder of mapped
network drives. W32/Gibe-F may also attempt to spread via usenet 
newsgroups (NNTP)."

-- 
Mvh,
Andr? Tomt
andre@tomt.net

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/