-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello TBUDL Members! Sorry to crosspost but there is some serious matter at hand. Today I got some mails with a virus warning. It does not affect TB! but has some curious features. we now try to examine what to do and what exactly the virus does. It seems to come as an attachement called "cfgwitz32.exe"; I myself did not get this attachement neither through GMx (they may have stripped it) nor through my own domain (which wouldn't have stripped it). What I got (and still get periodically, which may be due to some network damage the virus may do) is a mail with a seemingly randomly chosen text from a text file, the virus found on the hard disk. In this special case it was some sensitive information from a former employer (luckily we are still on good terms). The subject of the message was: \*MERGEFORMAT. It may have took that from the used file or created it itself. Another thing the virus does, it changes the sender address in the RETURN-PATH header. I have only two instances to check on this so we cannot be sure what the rule is. But it looks like it takes the second letter in the name part of the e-mail address and changes it to the next letter in the alphabet. The two instances I know of sadly both had an "a" at the second position, which was changed to "b". I hope someone here can help me, and I hope I can help with this mail some of you. - -- Dierk Haasis PGP keys available: mailto:[EMAIL PROTECTED]?Subject=SendMyPGPkeys The Bat 1.52 Beta/7 Windows 95 4.0 1212 C Assumptions are the mother of all screw ups. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8ckt Comment: Privacy is the core element of freedom! iQA/AwUBOt6oUPTo1oA8g8dLEQLNNACggPkijJ+kqTA4MZnIvZ2cSBP206EAoOgC xZoh3HDdb8UyQysfQupNsn6k =cnQZ -----END PGP SIGNATURE----- -- ______________________________________________________ Archives : <http://tbudl.thebat.dutaint.com> Moderators : <mailto:[EMAIL PROTECTED]> TBTech List: <mailto:[EMAIL PROTECTED]> Unsubscribe: <mailto:[EMAIL PROTECTED]> You are subscribed as : [email protected]
