Here is the full source of the message I received:
*********************************************************
From - Wed Apr 20 11:50:28 2005
X-Account-Key: account2
X-UIDL: Mail1114022941036-2558
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
Return-Path: <[EMAIL PROTECTED]>
Received: from 199.231.128.19 ([199.231.128.19])
by Shadow (JAMES SMTP Server 2.2.0) with SMTP ID 84
for <[EMAIL PROTECTED]>;
Wed, 20 Apr 2005 11:49:00 -0700 (PDT)
Received: from Andydesktop.com ([12.210.208.58]) by cflib.org with MailEnable ESMTP; Wed, 20 Apr 2005 14:43:55 -0400
Date: Wed, 20 Apr 2005 13:48:14 -0600
To: "Cfcdev" <[email protected]>
From: "Cfcdev-owner" <[EMAIL PROTECTED]>
Subject: [CFCDev]
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------loinzmrmxvfznbesjxay"
Precedence: bulk
Reply-To: [email protected]
Sender: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
----------loinzmrmxvfznbesjxay Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: 7bit
<html><body> <br><br>
<br> </body></html>
----------------------------------------------------------<BR>You are subscribed to cfcdev. To unsubscribe, send an email to [email protected] with the words 'unsubscribe cfcdev' as the subject of the email.<BR><BR>CFCDev is run by CFCZone (www.cfczone.org) and supported by CFXHosting (www.cfxhosting.com).<BR><BR>An archive of the CFCDev list is available at<BR>www.mail-archive.com/[email protected]
----------loinzmrmxvfznbesjxay Content-type: text/plain; charset=iso-8859-1 Content-Disposition: attachment;filename=McAfee_EmailScanReport.txt Content-Transfer-Encoding: quoted-printable
****************** McAfee VirusScan ************************ ******* Alert generated at: Wed, 20 Apr 2005 11:50:35 -0800 ********* *********************************************************************
McAfee VirusScan has detected a potential threat in this e-mail=20 sent by "Cfcdev-owner" <[EMAIL PROTECTED]>. The following actions were attempted on each suspicious part.=20 We strongly recommend that you report this virus-related activity=20 to "Cfcdev-owner" <[EMAIL PROTECTED]>.
The attachment "Work.zip" is infected with the W32/[EMAIL PROTECTED] Virus(es)= =2E This attachment has been quarantined.
----------loinzmrmxvfznbesjxay--
.
*********************************************************
Jim Davis wrote:
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rob Brooks-Bilson Sent: Wednesday, April 20, 2005 6:14 PM To: [email protected] Subject: [CFCDev] Viruses on CFCDev
I will remote into our server tonight and perform a manual scan to determine whether the virus is being sent from our box or not. As we don't actually read emails on the box, and we have a virus scanner scanning inbound and outbound mail, I'm not sure how we would have become infected, although stranger things have happened. I'll post to the list when I know more.
I REALLY doubt the mail originated from your box Rob - my guess is that the sending address was spoofed. Does anybody still have the mail and could they post the headers from it?
Many people didn't get the mail - that alone leads me to believe that the listserv didn't send it.
Jim Davis
---------------------------------------------------------- You are subscribed to cfcdev. To unsubscribe, send an email to [email protected] with the words 'unsubscribe cfcdev' as the subject of the email.
CFCDev is run by CFCZone (www.cfczone.org) and supported by CFXHosting (www.cfxhosting.com).
An archive of the CFCDev list is available at www.mail-archive.com/[email protected]
--
-------------------------------------------- Stephen Milligan Code poet for hire http://www.spike.org.uk
Do you cfeclipse? http://cfeclipse.tigris.org
---------------------------------------------------------- You are subscribed to cfcdev. To unsubscribe, send an email to [email protected] with the words 'unsubscribe cfcdev' as the subject of the email.
CFCDev is run by CFCZone (www.cfczone.org) and supported by CFXHosting (www.cfxhosting.com).
An archive of the CFCDev list is available at www.mail-archive.com/[email protected]
