FWIW, I've received a similar message.
It sounds like somebody who receives the list is infected (not a very
limited crew) and the malicious code is using the email addresses of
posters as seeds. I'm pretty sure my OpenSuse box doesn't really have
I tried to find my offending messages in the archives, but it isn't
there yet (lag or smart administration).
If the spoofed return address messages really have a worm in them, I
hope they don't make it to the archives! On the other hand, somebody
needs to look at the headers of the messages to see where they really
On 9/24/05, Benjamin Podszun <firstname.lastname@example.org> wrote:
> Hi there.
> I just got a warning from email@example.com, telling
> me that some messages bounced when ezmlm tried to deliver them..
> Below is the complete warning, at the end of the mail you'll find the
> reason. I'm going to paste it for all guys too lazy to scroll =)
> Hi. This is the qmail-send program at tigris.org.
> I'm afraid I wasn't able to deliver your message to the following
> This is a permanent error; I've given up. Sorry it didn't work out.
> 126.96.36.199 failed after I sent the message.
> Remote host said: 550 This message contains a virus or other harmful
> content (Worm.Mytob.BM-2)
> Well - YES, I won't accept worms as eMail. Thanks for pointing out
> that I got two again, ezmlm. Glad to know..
> Seriously: Is anyone actively maintaining this mailing list? Is it
> possible to stop accept this worms for the ml completely (clamav,
> whatever)? How is this bouncing bad for my list account? Is it reset
> to zero bounces regularly? Or am I unsubscribed when I bounce the
> next worm that some jerk sends to this list?
> Sorry - I'm just unsure about the proper handling. I can either
> unsubscribe and don't worry (web-archive or something related has the
> same infos, nevertheless) or stay subscribed and still don't accept
> virii, worms, trojans, windows executables etc.
> Is there a policy? Any comment from a project-/list-maintainer?
> Thanks in advance,
> Anfang der weitergeleiteten E-Mail:
> > Von: firstname.lastname@example.org
> > Datum: 24. September 2005 20:47:03 MESZ
> > An: email@example.com
> > Betreff: ezmlm warning
> > Hi! This is the ezmlm program. I'm managing the
> > firstname.lastname@example.org mailing list.
> > Messages to you from the users mailing list seem to
> > have been bouncing. I've attached a copy of the first bounce
> > message I received.
> > If this message bounces too, I will send you a probe. If the probe
> > bounces,
> > I will remove your address from the users mailing list,
> > without further notice.
> > I've kept a list of which messages from the users mailing list have
> > bounced from your address.
> > Copies of these messages may be in the archive.
> > To retrieve a set of messages 123-145 (a maximum of 100 per request),
> > send an empty message to:
> > <email@example.com>
> > To receive a subject and author list for the last 100 or so messages,
> > send an empty message to:
> > <firstname.lastname@example.org>
> > Here are the message numbers:
> > 37925
> > 38412
> > --- Enclosed is a copy of the bounce message I received.
> > Return-Path: <>
> > Received: (qmail 27118 invoked for bounce); 13 Sep 2005 01:47:36 -0000
> > Date: 13 Sep 2005 01:47:36 -0000
> > From: MAILER-DAEMON@tigris.org
> > To: email@example.com
> > Subject: failure notice
> > Hi. This is the qmail-send program at tigris.org.
> > I'm afraid I wasn't able to deliver your message to the following
> > addresses.
> > This is a permanent error; I've given up. Sorry it didn't work out.
> > <firstname.lastname@example.org>:
> > 188.8.131.52 failed after I sent the message.
> > Remote host said: 550 This message contains a virus or other
> > harmful content (Worm.Mytob.BM-2)
> To unsubscribe, e-mail: email@example.com
> For additional commands, e-mail: firstname.lastname@example.org
To unsubscribe, e-mail: email@example.com
For additional commands, e-mail: firstname.lastname@example.org
Received on Sun Sep 25 00:31:53 2005