[Esd-l] One worm sticking its tongue out at another?

[John D. Hardin]

Check out the From: address on this one...

On Sun, 29 Feb 2004, Procmail Security daemon wrote:

> $Revision: 1.141pre12 $
> 
> REPORT: Scanned attachment "cebdeeae.zip"
> REPORT: Trapped suspicious zipped files:
> REPORT:  yeuuwcrn.exe
> REPORT: Not a document, or already poisoned by filename. Not scanned for macros.
> STATUS: Message quarantined in /var/spool/mail/security, not delivered to recipient.
> NOTICE: Envelope sender domain mm.html not supported by Received: path. Suppressing sender notification.
> 
> 
> Headers from message:
> 
> > From w32.nimda.a at mm.html  Sun Feb 29 18:31:40 2004
> > Return-Path: <w32.nimda.a at mm.html>
> > Received: from schandell (turfir19.lnk.telstra.net [139.130.163.49])
> > 	by hq.impsec.org (8.11.6/8.9.3) with SMTP id i212VKI19599
> > 	for <jhardin at impsec.org>; Sun, 29 Feb 2004 18:31:23 -0800
> > Date: Mon, 01 Mar 2004 10:54:02 +1000
> > To: jhardin at impsec.org
> > Subject: Jenny
> > From: w32.nimda.a at mm.html
> > Message-ID: <pelkvguamajtabtycvy at mm.html>
> > MIME-Version: 1.0
> > X-Security: message sanitized on hq.impsec.org
> > 	See http://www.impsec.org/email-tools/sanitizer-intro.html
> > 	for details. $Revision: 1.141pre12 $Date: 2004-02-11 20:47:43-08 
> > Content-Type: multipart/mixed;
> >         boundary="--------kmyoivyftvcjicikenpa"

It'll take me half an hour to recover from the hiccups now...

--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org                        pgpk -a jhardin at impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
  does quite what I want. I wish Christopher Robin was here."
				-- Peter da Silva in a.s.r
-----------------------------------------------------------------------
   34 days until the Slovakian Presidential Election