From owner-freebsd-security@FreeBSD.ORG  Fri Oct 24 09:02:55 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 301E616A4B3
	for <security@freebsd.org>; Fri, 24 Oct 2003 09:02:55 -0700 (PDT)
Received: from fep3.cogeco.net (smtp.cogeco.net [216.221.81.25])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3B30643FD7
	for <security@freebsd.org>; Fri, 24 Oct 2003 09:02:54 -0700 (PDT)
	(envelope-from ph1@cogeco.ca)
Received: from cogeco.ca (d141-223-207.home.cgocable.net [24.141.223.207])
	by fep3.cogeco.net (Postfix) with ESMTP
	id 5FCA51C95; Fri, 24 Oct 2003 12:02:53 -0400 (EDT)
Message-ID: <3F994D6E.5080409@cogeco.ca>
Date: Fri, 24 Oct 2003 12:03:58 -0400
From: David <ph1@cogeco.ca>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
	rv:1.5) Gecko/20030925
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Brett Glass <brett@lariat.org>
References: <6.0.0.22.2.20031023162326.04c1e008@localhost>
In-Reply-To: <6.0.0.22.2.20031023162326.04c1e008@localhost>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: security@freebsd.org
Subject: Re: /var partition overflow (due to spyware?) in FreeBSD default
  install
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Oct 2003 16:02:55 -0000

Brett Glass wrote:

[snip]

> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS 
> (ns11.opennic.glue)
> 
> The references to OpenNIC have caused me to suspect (though I have not 
> verified it yet) that the problem is due to the New.Net spyware, which 

Seeing how nobody else has noted it, OpenNIC is *not* New.net

[snip]