Up Prev Next
From: dowen at midsomer dot org
Subject: Re: Virus Alert
Date: May 13 2002 7:21PM
Blimey. I didn't even see it (which, I think, the default behaviour for
the list). It is unlikely to have come from me since I don't use any
M$ products at home, apart from a second partition on my laptop to allow
me to watch movies on planes and test ASE on NT.
> Content-Type: text/plain
> Content-Transfer-Encoding: quoted-printable
> On Mon, 2002-05-13 at 05:34, Marco Hernandez wrote:
> > Greetings,
> > It appears that a recent posting to the list contained the=20
> > following virus/worms.
> > W32/Klez.h@MM=20
> > W32/Klez.h@MM=20
> > These came as an attachment. I have not figured out which=20
> > posting but given the number of bounces from firewalls w/anti=20
> > virus software I thought I'd pass this along.
> It looks like this message has the virus/worm:
> From: dowen
> To: SybPerl Discussion List
> Subject: Festival of American Folklife
> MIME-Version: 1.0
> Content-Type: multipart/alternative; boundary=3DLsU3ZOAh85k9A7K2g41
> Message-Id: <20020513114151.86AA9140A1@mail1out.giga.net.tw>
> Date: Mon, 13 May 2002 19:41:51 +0800 (CST)
> Reply-To: SYBPERL-L@list.cren.net
> Sender: owner-SYBPERL-L@list.cren.net
> There's only a very small probability that David Owen would send a
> message from giga.net.tw... :-), and an even smaller chance that he'd
> send a message on some festival of American Folklife...
> And no - this does not mean that David's machine(s) is infected - in
> case you haven't heard the Klez worm remails itself with "from"
> addresses culled from the user's machine - not just with the "from"
> address of the infected user.
> I've a had quite a few copies come here with a "from" address set to the
> old sybperl-l list (before it was moved to cren.net).
> Michael Peppler Data Migrations, Inc.
> firstname.lastname@example.org *or* email@example.com
> International Sybase User Group: http://www.isug.com
> Content-Type: application/pgp-signature; name=signature.asc
> Content-Description: This is a digitally signed message part
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> -----END PGP SIGNATURE-----