sybperl-l Archive

From: Michael Peppler <mpeppler at peppler dot org>
Subject: Re: Virus Alert
Date: May 13 2002 1:16PM

On Mon, 2002-05-13 at 05:34, Marco Hernandez wrote:
> Greetings,
> 
> It appears that a recent posting to the list contained the 
> following virus/worms.
> 
> W32/Klez.h@MM 
> W32/Klez.h@MM 
> 
> These came as an attachment.  I have not figured out which 
> posting but given the number of bounces from firewalls w/anti 
> virus software I thought I'd pass this along.

It looks like this message has the virus/worm:

From: dowen 
To: SybPerl Discussion List 
Subject: Festival of American Folklife
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=LsU3ZOAh85k9A7K2g41
Message-Id: <20020513114151.86AA9140A1@mail1out.giga.net.tw>
Date: Mon, 13 May 2002 19:41:51 +0800 (CST)
Reply-To: SYBPERL-L@list.cren.net
Sender: owner-SYBPERL-L@list.cren.net

There's only a very small probability that David Owen would send a
message from giga.net.tw... :-), and an even smaller chance that he'd
send a message on some festival of American Folklife...

And no - this does not mean that David's machine(s) is infected - in
case you haven't heard the Klez worm remails itself with "from"
addresses culled from the user's machine - not just with the "from"
address of the infected user.

I've a had quite a few copies come here with a "from" address set to the
old sybperl-l list (before it was moved to cren.net).

Michael
-- 
Michael Peppler                              Data Migrations, Inc.
mpeppler@peppler.org           *or*          mpeppler@mbay.net
http://www.mbay.net/~mpeppler
International Sybase User Group: http://www.isug.com