OT Virus: Not I!

[Sarah Fox]

> Hi List,
>
> My Mailwasher has just detected a virus from Sarah Fox @ Goldrush.com,
with
> the subject "Key leads and inertia"

Yikes!  I got it too.  Since I don't often send emails to myself -- or to
any of my other alter egos -- I treated it with considerable suspicion and
did not open the attachment.

My computer is free of viruses, unless this is something not yet profiled in
the Norton/Symantec virus definitions.  The virus apparently came from
someone else, as evidenced by the header (read in order from the last
"received" line to the first):

Return-path: <sarah@goldrush.com>
Received by etc., etc.  -- the normal route to my computer.  (I've omitted
all but my reflector address because these messages get archived, and I
don't want to get spam through my primary address!)
Received: from mail.surferz.net (mail.surferz.net [64.80.52.17])
 by tnmx01.mgw.rr.com (8.12.8p1/8.12.8) with ESMTP id h5O0859h021846 for
 XXXXXX@XXXXXXX; Mon, 23 Jun 2003 20:08:05 -0400 (EDT)
Received: from sv.compuland.com.br (sv.compuland.com.br [200.255.96.21])
 by mail.surferz.net (8.12.6/8.12.6) with ESMTP id h5O05QOG025995 for
 <sarah@gendernet.org>; Mon, 23 Jun 2003 20:05:27 -0400 (EDT)
Received: from theboss (dial539.compuland.com.br [200.214.11.190])
 by sv.compuland.com.br (8.12.5/8.12.9) with SMTP id h5O00pQd013316; Mon,
 23 Jun 2003 21:00:54 -0300 (BRT envelope-from sarah@goldrush.com)
Date: Mon, 23 Jun 2003 21:00:51 -0300 (BRT)
From: Sarah Fox <sarah@goldrush.com>
Subject: Re: Key Leads and Inertia

Thus, the email originated from a brazilian address with a return address
that I've never had (sarah@goldrush.com).  It purportedly made its way from
"theboss" (dial539.compuland.com.br) to my address at gendernet.org and then
was reflected through Norton to my cable internet server.  "Theboss" is
probably not to blame -- probably another forgery.

The content of the virus-forged email was most likely gleaned from the
PianoTech archives.  If the virus works like most worms, it probably mailed
itself, with the forged content, to everyone in the infected computer's
address book.  Therefore it's probably one of us.  It's most likely someone
who has been visiting the archives -- again, not I.

Soooo....  If you've visited the archives lately and have both myself and
Alan -- and now Bill Ballard -- in your address book (probably if you've
sent us all emails privately), do a virus scan!  (Note: for those concerned,
I have neither in my address book.  I checked.)

Peace,
Sarah