Subject: RE: formularze (INFECTED)

From: Mike Rowan <[email-masked]>
Date: Fri, 20 Sep 2002 12:12:51 -0400

Please protect your system with a virus protection engine, these are readily
available today.  Below is the information sent in your post to this list.
Thank you.

Sender of the infected attachment:  ambarish
Subject of the message:  formularze
One or more attachments were quarantined.
  Attachment formularze.mpg
.pif was Quarantined for the following reasons:
    Virus W32.Yaha.F@mm was found.

Michael J. Rowan
Director, Product Management
Enterprise Security Services
GeoTrust, Inc.
781.263.4124 (direct)
401.952.1240 (mobile)

[email-masked]
www.geotrust.com

-----Original Message-----
From: ambarish [mailto:[email-masked]] 
Sent: Sunday, September 01, 2002 12:05 PM
To: [email-masked]
Subject: formularze

---

From: "Ambarish Malpani" <[email-masked]>
Date: Fri, 20 Sep 2002 11:05:59 -0700

Hi Mike,
    The mail was a spam. Came from somewhere in Poland. Wasn't
sent by me. Just claims to be sent by me.

Here is a mail I got from Paul (Hoffman):

-------------Begin included mail - including my message to Paul----

>Do you have easy access to the orginal mail you received. I
>want to know whether the mail actually originated from
>ValiCert or somebody is just spoofing the name.

I don't have them, but you can see for yourself that it was relayed
through a system in .pl. It's clearly a worm/virus.

The mail log entry says:

Sep 20 07:04:30 above sendmail[12331]: g8KE4Tk12331:
from=<[email-masked]
>, size=39749, class=0, nrcpts=1,
>msgid=<[email-masked].
com>, proto=SMTP, daemon=MTA25, relay=robot.unizeto.pl [217.153.69.1]

--Paul Hoffman, Director
--Internet Mail Consortium

----------------End Inclusion-------------------------------

---------------------------------------------------------------------
Ambarish Malpani                                         650.759.9045
Malpani Consulting Services                      [email-masked]
http://www.malpani.biz

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Mike Rowan
> Sent: Friday, September 20, 2002 9:13 AM
> To: 'ambarish'; [email-masked]'
> Subject: RE: formularze (INFECTED)
>
>
>