Greetings
I have to inform you that one of supposedly your computers, conected to
the internet by IP 212.16.44.41 has flooded the Arachne browser
e-mail discussion list with more than 20 copies of the [EMAIL PROTECTED]
worm since yesterday Aug 19 2003. Below there's a copy of a tipical
message header. Take a glance at the originating IP.
Received: from home.arachne.cz (ns.arachne.cz [212.24.129.58])
by andromeda.totalnet.ro (Postfix) with ESMTP id AC25CBF1DB
for <[EMAIL PROTECTED]>; Wed, 20 Aug 2003 12:23:51 +0300 (EEST)
Received: from CCTS02 (GW-CALLCENTER.AIRCALL.AT [212.16.44.41] (may be
forged))
by home.arachne.cz (8.12.9/8.12.6) with ESMTP id h7K95E7d021724
for <[EMAIL PROTECTED]>; Wed, 20 Aug 2003 11:05:15 +0200
Message-Id: <[EMAIL PROTECTED]>
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Re: Thank you!
Date: Wed, 20 Aug 2003 11:08:22 +0200
X-MailScanner: Found to be clean
Importance: Normal
The virus spoofs the "From:" and "Reply to:" fields, so these can't be
taken into account. the "X-Mailscanner: " field is bogus and it is added
by the virus itself.
Hoping that someone will there will disinfect the respective computer, I
wish you all the best
Cristian Burneci
Bucharest, Romania
