Subject: FVWM: Viruses from FVWM list

From: "Talbot-Wilson, Michael (FORENSIC)" <[email-masked]>
Date: Mon, 18 Dec 2000 12:58:02 +1030

On three occasions in recent weeks I have received a message from my
employer's DMZ saying that a scan had detected a virus in a message from the
FVWM list.

It is the only mailing list I am subscribed to from here, so I have no basis
for comparison, and can't tell you there is a particular problem with this
list, but you might as well know it's happening.

I've also received this (following) message from owner-fvwm, with
attachments that I won't attempt to read on a Microsoft operating system
(have forwarded them to a Linux system where I will read them later).  ARNIE
is one of the servers in the DMZ, but I'm not sure whether the message from
the list refers to the same arnie.  In any case, since I have sent no
messages to the list recently, the trojan horse (if that is what it is) must
have come from there, so again it may be of interest to subscribers.

------------------  Virus Warning Message (on arnie)

Found virus TROJ_HYBRIS.D in file PPDJCPPP.EXE
The file PPDJCPPP.EXE is moved to /apps/virusscan/infected/virXNC08WHoS
--
Visit the official FVWM web page at <URL: http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].

---

From: Andre Goeree <[email-masked]>
Date: Mon, 18 Dec 2000 08:45:53 +0100

> The file PPDJCPPP.EXE is moved to /apps/virusscan/infected/virXNC08WHoS

I have received the same messages (3) too.
Luckily i don't run a Windows box.....

---

From: David Proulx <[email-masked]>
Date: Mon, 18 Dec 2000 09:39:04 -0800 (PST)

Sending a Windoze virus to the "fvwm" mailing list is really pretty 
stupid (and harmless)...

Dave