Subject: RE: [idn] Nimda virus information

From: Yves Arrouye <[email-masked]>
Date: Wed, 7 Nov 2001 10:26:46 -0800

Yes, sorry about that. My IT department is investigating. I have an
anti-virus running that didn't detect anything, and the Symantec removal
tool also declared my machine to be safe. I am puzzled, but someone
hopefully more competent on virus issues is working on it.

YA

---

From: YangWoo Ko <[email-masked]>
Date: Thu, 8 Nov 2001 10:19:24 +0900

> hopefully more competent on virus issues is working on it.

According route informatin in the mail header, it was NOT originated
from Yves but from somewhere else. Maybe virus forge sender field
of mail message.

-- 
/*------------------------------------------------
YangWoo Ko : [email-masked]
We Invent Enterprise Software Solutions
and Make You Secure & Powerful.
------------------------------------------------*/

---

From: "Bruce Thomson" <[email-masked]>
Date: Thu, 8 Nov 2001 11:28:27 +0900

> from Yves but from somewhere else. Maybe virus forge sender field
Or possibly the virus has infected another computer Yves has used in
the past to post to this list. It should be possible to figure it out from the
mail headers, but I already deleted my copy of the infected mail.

---

From: YangWoo Ko <[email-masked]>
Date: Thu, 8 Nov 2001 11:59:15 +0900

> mail headers, but I already deleted my copy of the infected mail.

I attached infected mail header. Please see where it started its journey.
I overwrite IP address with '?' to avoid unintended dispute.

) Date: Tue, 06 Nov 2001 17:54:03 -0800
) From [email-masked]  Wed Nov  7 12:00:50 2001
) From: <[email-masked]>
) Subject: [idn] ip
) Return-Path: <[email-masked]>
) Received: from psg.com (psg.com [147.28.0.62])
)	 by nexus.spsoft.co.kr (8.10.0/8.10.0) with ESMTP id fA7301l01436
)	 for <[email-masked]>; Wed, 7 Nov 2001 12:00:08 +0900
) Received: from lserv by psg.com with local (Exim 3.33 #1)
)	id 161Hut-0003c9-00
)	for [email-masked]; Tue, 06 Nov 2001 17:54:11 -0800
) Received: from [???.???.?.??] (helo=ALBERT)

                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^

)	by psg.com with smtp (Exim 3.33 #1)
)	id 161Hul-0003bw-00
)	for [email-masked]; Tue, 06 Nov 2001 17:54:03 -0800
) MIME-Version: 1.0
) Content-Type: multipart/related;
)	type="multipart/alternative";
)	boundary="====_ABC123456j7890DEF_===="
) X-Priority: 3
) X-MSMail-Priority: Normal
) X-Unsent: 1
) Message-Id: <[email-masked]>
) Bcc:
) Sender: [email-masked]
) Precedence: bulk

---

From: "Bruce Thomson" <[email-masked]>
Date: Thu, 8 Nov 2001 13:52:55 +0900

> ) Received: from [???.???.?.??] (helo=ALBERT)

Well, the IP address you replaced with ??? is where the infected
mail came from. It's just a Windows machine infected by Nimda
that happened to have the idn mailing list in its address book. My
guess is it's Yves' computer at home or somewhere, but in any case
case the owner is an innocent victim like the rest of us.

(For those who don't know how Nimda works, once a computer
is infected, it automatically mails everyone in your address book
with infected messages.)

Bruce

---

From: Keith Moore <[email-masked]>
Date: Thu, 08 Nov 2001 08:22:44 -0500

> mail headers, but I already deleted my copy of the infected mail.

no, that's not what's happening.  this virus forges return addresss
based on other addresses it has seen.  I've seen it forge mail from my
address, even though I have *never* originated mail from a Windows system.
(and never will)

Keith