[plug] Here to find out more!

Sat Aug 17 01:21:23 WST 2002

Here's the important line...
Received: from Ggkaysppu (ppp-64-217-176-21.dialup.lgvwtx.swbell.net
[64.217.176.21])

That's the person who's machine is sending the Klez worm (prolly without 
the user knowing) and until they disinfect their machine it'll keep going.

/Kai

Arie Hol wrote:
> Greetings to All,
> 
> I have just received another email from the list that contains a virus, this
> email appears to have been posted by <chrisg at doladns.dola.wa.gov.au>, it is
> not the first email of this type that I have received in the last few weeks. 
> 
> There was also an attachment to this email named 'B962197' and according to
> my virus scanner it contained the 'W32/Klez.h at MM' virus.
> 
> Could somebody please explain to me 'What is happening here ?'
> 
> I am getting the opinion that because Linux may be a lesser risk as regards
> viruses that it is still OK for Linux users to allow virus loaded
> attachments to go to Windows users.
> 
> I may be wrong but I don't think this is a good way to get poeple to change
> over to Linux.
> 
> See the following for the full content of the affected email message:
> 
> Start of Message
> ----------------
> 
> Return-Path: <plug-request at plug.linux.org.au>
> Received: from spark.plug.linux.org.au ([203.190.202.16])
>           by mta05.mail.mel.aone.net.au with ESMTP
>           id
> <20020816055747.YSQM24106.mta05.mail.mel.aone.net.au at spark.plug.linux.org.au>
>           for <arie99 at ozemail.com.au>; Fri, 16 Aug 2002 15:57:47 +1000
> Received: by spark.plug.linux.org.au (Postfix, from userid 38)
> 	id 5A88779F0; Fri, 16 Aug 2002 13:56:54 +0800 (WST)
> Old-Return-Path: <owner-plug at plug.linux.org.au>
> Delivered-To: plug at plug.linux.org.au
> Received: from pimout2-ext.prodigy.net (pimout2-ext.prodigy.net
> [207.115.63.101])
> 	by spark.plug.linux.org.au (Postfix) with ESMTP id 8F00979F0
> 	for <plug at plug.linux.org.au>; Fri, 16 Aug 2002 13:56:25 +0800 (WST)
> Received: from Ggkaysppu (ppp-64-217-176-21.dialup.lgvwtx.swbell.net
> [64.217.176.21])
> 	by pimout2-ext.prodigy.net (8.11.0/8.11.0) with SMTP id g7G5tmb436284
> 	for <plug at plug.linux.org.au>; Fri, 16 Aug 2002 01:55:49 -0400
> Date: Fri, 16 Aug 2002 01:55:49 -0400
> Message-Id: <200208160555.g7G5tmb436284 at pimout2-ext.prodigy.net>
> From: chrisg <chrisg at doladns.dola.wa.gov.au>
> To: plug at plug.linux.org.au
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> 	boundary=Fg3ri1bt079
> Subject: [plug] Here to find out more!
> Resent-Message-ID: <XcGErC.A.-M.lQJX9 at spark>
> Resent-From: plug at plug.linux.org.au
> X-Mailing-List: <plug at plug.linux.org.au> archive/latest/22351
> X-Loop: plug at plug.linux.org.au
> Reply-To: plug at plug.linux.org.au
> Precedence: list
> Resent-Sender: plug-request at plug.linux.org.au
> Resent-Date: Fri, 16 Aug 2002 13:56:54 +0800 (WST)
> 
> Content-Type: text/html;
> 
> 
> <HTML><HEAD></HEAD><BODY>
>                                                         
> <FONT></FONT></BODY></HTML>
> Content-Type: audio/x-midi;
> 	name=B962197;sz=240x400;ord=2002.8.15.6.25.461.bat
> 
> Content-ID: <RYY1UE57o>
> 
> Attachment Converted: D:\Internet\E-mail\B962197
> Content-Type: application/octet-stream;
> 	name=B962197;sz=240x400;ord=2002.8.15.6.25.46[1].html
> Content-Transfer-Encoding: base64
> Content-ID: <RYY1UE57o>
> 
> PGh0bWw+PGhlYWQ+PHRpdGxlPkNsaWNrIGhlcmUgdG8gZmluZCBvdXQgbW9yZSE8L3RpdGxl
> PjwvaGVhZD48Ym9keSBiZ2NvbG9yPSNmZmZmZmYgbWFyZ2lud2lkdGg9MCBtYXJnaW5oZWln
> aHQ9MCBsZWZ0bWFyZ2luPTAgdG9wbWFyZ2luPTA+PGEgdGFyZ2V0PSJfYmxhbmsiIGhyZWY9
> Imh0dHA6Ly9hZC5kb3VibGVjbGljay5uZXQvY2xpY2s7aD12MnwyZThkfDB8MHwlMmF8Zzsz
> OTY5NDY2OzAtMDswOzY5ODA5MjA7NDI1MS0yNDB8NDAwOzU1OTM1NHw1NTg2NTV8MTs7JTNm
> aHR0cDovL3d3dy5jbGFyaW5leC5jb20vLS9yZWJhdGUvbWFpbiI+PGltZyBzcmM9Imh0dHA6
> Ly9tLmRvdWJsZWNsaWNrLm5ldC92aWV3YWQvNTk4Mjg5L0NSWF80OTI1X3RyMl8yNDB4NDAw
> XzIzay5naWYiIGJvcmRlcj0wIGFsdD0iQ2xpY2sgaGVyZSB0byBmaW5kIG91dCBtb3JlISI+
> PC9hPjwvYm9keT48L2h0bWw+
> 
> --------------
> End of Message
> --------------
> 
> Regards Arie
> 
> 
>>--------------------------------------------<
> 
> 
> For the concert of life, nobody has a program.
> 
> 
>>--------------------------------------------<
> 
> 
> 
> 