>>>>> "sjoerd" == sjoerd <[EMAIL PROTECTED]> writes:
sjoerd> Since tcpdump changed from plain text to webbased mkailing list I
sjoerd> got a virus warning that is says there is a worm in you messages.
The list itself refuses ALL html messages, last I checked.
>>>>> "sjoerd" == sjoerd <[EMAIL PROTECTED]> writes:
sjoerd> Message-Id: <[EMAIL PROTECTED]>
sjoerd> Received: from Cgcahis ([203.162.0.55]) by mu11.vnn.vn (Netscape
sjoerd> Messaging Server 4.15) with SMTP id GX1C9L04.PAI for
sjoerd> <[EMAIL PROTECTED]>; Sat, 1 Jun 2002 23:24:57 +0700
sjoerd> From: mcr <[EMAIL PROTECTED]>
sjoerd> To: [EMAIL PROTECTED]
As you may well know, the various KLEZ viruses use random From:
addresses. It isn't clear from reading your if this message really went
through the mailing list. There are no Received: lines from *my machine*, but
perhaps your mail system has cut them out?
If so, the virus got lucky and used a From: address that actually could
post. Did this message actually go out to others? I probably didn't notice
and just deleted it.
sjoerd> Subject: [tcpdump-announce] Meeting notice
sjoerd> MIME-Version: 1.0
sjoerd> X-Security: MIME headers sanitized on www.ehbogerlach.nl
sjoerd> See http://www.impsec.org/email-tools/sanitizer-intro.html
sjoerd> for details. $Revision: 1.134 $Date: 2002-04-21 16:30:40-07
sjoerd> X-Security: The postmaster has not enabled quarantine of poisoned messages.
sjoerd> Content-Type: multipart/alternative;
sjoerd> boundary=Mq40x0M6m5r9xX31j9OC13pQ
sjoerd> Sender: [EMAIL PROTECTED]
sjoerd> Precedence: bulk
sjoerd> Reply-To: [EMAIL PROTECTED]
sjoerd> Status: RO
sjoerd> X-Status:
sjoerd> X-Keywords:
sjoerd> X-UID: 6667
sjoerd> --Mq40x0M6m5r9xX31j9OC13pQ
sjoerd> Content-Type: text/plain; charset=us-ascii
sjoerd> Content-Transfer-Encoding: 7bit
sjoerd> ------------------ Virus Warning Message (on the network)
sjoerd> Found virus WORM_KLEZ.E in file webperf.sourceforge
sjoerd> The uncleanable file is deleted.
sjoerd> ---------------------------------------------------------
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
