[plug] attachment sent

[Craig Ringer]

On Mon, 2004-03-01 at 14:31, James Devenish wrote:

> I seriously doubt it came from the PLUG list. If it did, we would all
> have received it. 

Indeed. It will have had a spoofed From: address. There's a decent
chance it came from a PLUG member, though, as the infected user must've
had PLUG in their address book or mail archive.

> If it is a virus/
> worm, I also doubt that it would be a ZIP-format attachment

Actually, it's now /extremely/ common for viri to package themselves as
zip files. All the recent mass-mailing idiot-exploit trojans have done
this. This irritates me a lot, as MimeDefang is no longer sufficient to
cut out email viruses - I need clamav-miter as well. 

>  -- also, it
> is very common that the sender address is forged.

Indeed, and that's what will have happened in this case.

Craig Ringer