Subject: RE: formularze (INFECTED)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 20 Sep 2002 10:32:19 -0700

Hang on, before getting onto Ambarish, remember that the latest and greatest
strategy of viruses has been to fake the sender ID so that the infected host
is not known.

In some cases the virus causes the infected host to send messages from A
claiming to be from B and vice versa so that two people with completely
uninfected systems are bombarding each other with complaints about viruses.

Paul's mailer does not forward the original headers, proper.com being one of
his hosts so I can't trace the mail.

Received: from mail.imc.org (robot.unizeto.pl [217.153.69.1])
	by above.proper.com (8.11.6/8.11.3) with SMTP id g8KE4Tk12331
	for <[email-masked]>; Fri, 20 Sep 2002 07:04:29 -0700 (PDT)
Message-Id: <[email-masked]>

---

From: Mike Rowan <[email-masked]>
Date: Fri, 20 Sep 2002 13:45:16 -0400

If you will notice the reply was addressed no one person in particular,
instead was a reply to all.  The message came from someone having post
access to this list.  No need to point fingers nor brag about our virus
knowledge.  The purpose is to post a general message of concern.  No harm
done.

- Michael

---

From: Mike Rowan <[email-masked]>
Date: Fri, 20 Sep 2002 14:21:04 -0400

Thanks for the response Ambarish.  As I am sure you know the message was
sent as a notification to the list.  And, you have gone the extra mile to
track this.

- Michael 

-----Original Message-----
From: Ambarish Malpani [mailto:[email-masked]] 
Sent: Friday, September 20, 2002 2:06 PM
To: Mike Rowan; [email-masked]
Subject: RE: formularze (INFECTED)

Hi Mike,
    The mail was a spam. Came from somewhere in Poland. Wasn't sent by me.
Just claims to be sent by me.

Here is a mail I got from Paul (Hoffman):

-------------Begin included mail - including my message to Paul----

>Do you have easy access to the orginal mail you received. I want to 
>know whether the mail actually originated from ValiCert or somebody is 
>just spoofing the name.

I don't have them, but you can see for yourself that it was relayed through
a system in .pl. It's clearly a worm/virus.

The mail log entry says:

Sep 20 07:04:30 above sendmail[12331]: g8KE4Tk12331:
from=<[email-masked]
>, size=39749, class=0, nrcpts=1, 
>msgid=<[email-masked].
com>, proto=SMTP, daemon=MTA25, relay=robot.unizeto.pl [217.153.69.1]

--Paul Hoffman, Director
--Internet Mail Consortium

----------------End Inclusion-------------------------------

---------------------------------------------------------------------
Ambarish Malpani                                         650.759.9045
Malpani Consulting Services                      [email-masked]
http://www.malpani.biz

> From: [email-masked] 
> [mailto:[email-masked]]On Behalf Of Mike Rowan
> Sent: Friday, September 20, 2002 9:13 AM
> To: 'ambarish'; [email-masked]'
> Please protect your system with a virus protection engine, these are 
> readily available today.  Below is the information sent in your post 
> to this list. Thank you.
>
> Sender of the infected attachment:  ambarish
> Subject of the message:  formularze
> One or more attachments were quarantined.
>   Attachment formularze.mpg
> .pif was Quarantined for the following reasons:
>     Virus W32.Yaha.F@mm was found.
>
> Michael J. Rowan
> Director, Product Management
> Enterprise Security Services
> GeoTrust, Inc.
> 781.263.4124 (direct)
> 401.952.1240 (mobile)
>
> [email-masked]
> www.geotrust.com
>
>
> From: ambarish [mailto:[email-masked]]
> Sent: Sunday, September 01, 2002 12:05 PM
> To: [email-masked]
> Subject: formularze
>

---

From: Tony Bartoletti <[email-masked]>
Date: Fri, 20 Sep 2002 12:07:12 -0700

All,

Our laboratory announced yesterday a change in virus-firewall 
protocol.  Upon detecting an incoming infected email, they will simply 
"cleanse" the mail, and no longer generate separate automatic notification 
to the intended recipient, nor generate any reply to the (apparent) 
sender.  This is due to the Klez virus infestation, which spoofs sender 
addresses by gleaning them from the address books of infected victims.

What a world.

Cheers! ____tony____

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 20 Sep 2002 12:17:50 -0700

Perhaps if we all signed our mail with S/MIME?

	Phill

> From: Tony Bartoletti [mailto:[email-masked]]
> Sent: Friday, September 20, 2002 3:07 PM
> To: Mike Rowan; 'Ambarish Malpani'; Mike Rowan; [email-masked]'

---

From: Mike Rowan <[email-masked]>
Date: Fri, 20 Sep 2002 15:27:23 -0400

Good idea, signing makes sense.

- Michael 

-----Original Message-----
From: Hallam-Baker, Phillip [mailto:[email-masked]] 
Sent: Friday, September 20, 2002 3:18 PM
To: Tony Bartoletti; Mike Rowan; 'Ambarish Malpani'; Mike Rowan;
[email-masked]'

	Phill