Re: [CCMC] "Worm Klez.E"

Tue, 10 Jun 2003 10:38:13 -0700



Le mardi, 10 juin 2003, � 19:23 Europe/Brussels, nicolas a �crit :


Hehehe 
OK je veux bien.
Mais je re�ois des dizaines d'emails des postmasters de diff�rents
provider me signalant que "mon" message n'est pas pass�... et ce sont
des adresses que je ne connais m�me pas.
C'est �nervant � la fin. Rien qu'aujourd'hui j'en ai re�u 15.


Je te comprend. La solution est d'obtenir les headers du message. Avec cela
on conna�tra la source (si c'est une ip Skynet, je veux bien t'aider), et
kl'on pourra prevenir ton ami qui n'a pas conscience qu'il bombarde le net
avec un vieux virus.

Ceci dit ce virus est Macophobe!!!!!

Nicolas


Voici le dernier re�u (sorry si le message est trop long et inint�ressant pour la liste ) :

****************************
De: Mail Delivery System <[EMAIL PROTECTED]>
Date: Mar 10 juin 2003 13:19:03 Europe/Brussels
�: [EMAIL PROTECTED]
Objet: Mail delivery failed: returning message to sender
Return-Path: <[EMAIL PROTECTED]>
Received: from dee.skynet.be (dee.skynet.be [195.238.2.100]) by tick.skynet.be (8.12.9/8.12.9/Skynet-MAILSTORE-2.13) with ESMTP id h5ABJDox015724 for <[EMAIL PROTECTED]>; Tue, 10 Jun 2003 13:19:13 +0200 (MET DST) (envelope-from <>)
Received: from smtp-in.tiscali.be (mail-in1.tiscali.be [62.235.13.191]) by dee.skynet.be (8.12.9/8.12.9/Skynet-IN-2.32) with ESMTP id h5ABJ598012646 for <[EMAIL PROTECTED]>; Tue, 10 Jun 2003 13:19:05 +0200 (envelope-from <>)
Received: from mail by smtp-in.tiscali.be with local (Tiscali.be http://www.tiscali.be) id 19Ph9b-0002o4-1j for <[EMAIL PROTECTED]>; Tue, 10 Jun 2003 13:19:03 +0200
X-Failed-Recipients: [EMAIL PROTECTED]
Message-Id: <[EMAIL PROTECTED]>
X-Sa-Exim-Mail-From:
X-Spam-Status: No, hits=-1.6 required=5.0 tests=BAYES_20,LARGE_HEX,MAILER_DAEMON version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Sa-Exim-Version: 3.0 (built Fri May 30 17:18:00 CEST 2003)
X-Uidl: 194ca467ce6a658fdf7f90719a5a30df

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [EMAIL PROTECTED]
    This message has been rejected because it has
    a potentially executable attachment 6-ph-warche01[1].scr
    This form of attachment has been used by
    recent viruses or other malware.
    If you meant to send this file then please
    package it up as a zip file and resend it.
    If you didn't mean to send this file, and you are
    using microsoft outlook, you are probably infected.

------ This is a copy of the message, including all the headers. ------
------ The body of the message is 151409 characters long; only the first
------ 8192 or so are included here.

Return-path: <[EMAIL PROTECTED]>
Received: from sojef.skynet.be ([195.238.2.127])
by smtp-in.tiscali.be with esmtp (Tiscali.be http://www.tiscali.be)
id 19Ph9a-0002nt-DX
for <[EMAIL PROTECTED]>; Tue, 10 Jun 2003 13:19:02 +0200
Received: from Vmql (83.199-200-80.adsl.skynet.be [80.200.199.83])
by sojef.skynet.be (8.12.9/8.12.9/Skynet-OUT-2.21) with SMTP id h5ABIm12015105
for <[EMAIL PROTECTED]>; Tue, 10 Jun 2003 13:18:49 +0200
(envelope-from <[EMAIL PROTECTED]>)
Date: Tue, 10 Jun 2003 13:18:48 +0200
Message-Id: <[EMAIL PROTECTED]>
From: postmaster <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Returned mail--"May 19 2003 15"
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=D505G6IbX8a66C9VC38q64s7k
X-SA-Exim-Mail-From: [EMAIL PROTECTED]
X-SA-Exim-Scanned: No; Message bigger than SAmaxbody (40960)

--D505G6IbX8a66C9VC38q64s7k
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD></HEAD><BODY>

<FONT>The following mail can't be sent to [EMAIL PROTECTED]:<br>
<br>
From: [EMAIL PROTECTED]<br>
To: [EMAIL PROTECTED]<br>
Subject: May 19 2003 15<br>
The attachment is the original mail</FONT></BODY></HTML>

--D505G6IbX8a66C9VC38q64s7k
Content-Type: application/octet-stream;
        name=6-ph-warche01[1].scr
Content-Transfer-Encoding: base64
Content-ID: <X14b93zSYC1Qlw>

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4g
RE9TIG1vZGUuDQ0KJAAAAAAAAAAYmX3gXPgTs1z4E7Nc+BOzJ+Qfs1j4E7Pf5B2zT/gTs7Tn

**************************


--
PHOTO HALL Multimedia, leader en Telecom, Informatique,
Photo, Video, TV, Hifi. Surfez sur http://www.photohall.be
CyberCafe 2.0 <http://www.cybercafe.tv> Chaque Mardi 19h15 sur La 2!
Desabonnement par email :  <mailto:[EMAIL PROTECTED]>

Répondre à