From: Davis, Alan (Davis@tessco.com)
Date: Thu Jul 10 2003 - 11:26:08 EDT
For the moment, verify the content of any messages with attachments coming
from the syscheck_interest mailing list.
Note the name and mime-type of the attachment.
I received a message today that carried a Bugbear variant.
> Here are the headers from the email I got from the syscheck_interest mail
> server :
>
>
> Received: from xxx with SMTP (Microsoft Exchange Internet Mail Service
> Version 5.5.2653.13)
> id M17SYCSQ; Thu, 10 Jul 2003 10:18:51 -0400
> Received: from dl360-06.tessco.com (yyy)
> by tessco.com (PMDF V6.1 #30751) with ESMTP id
> <01KY39ATX14S8WXEYT@tessco.com>
> for davis@exchange.tessco.com (ORCPT davis@tessco.com); Thu,
> 10 Jul 2003 10:19:56 -0400 (EDT)
> Received: from ztxmail05.ztx.compaq.com (unverified)
> by dl360-06.tessco.com (Content Technologies SMTPRS 4.3.10)
> with SMTP id <T635820356c0a0ae65a11c@dl360-06.tessco.com> for
> <davis@tessco.com>; Thu, 10 Jul 2003 10:17:48 -0400
> Received: from mailrelay01.cce.cpqcorp.net
> (mailrelay01.cce.cpqcorp.net [16.47.68.171]) by ztxmail05.ztx.compaq.com
> (Postfix) with ESMTP id 52BE4C9EC; Thu, 10 Jul 2003 09:19:52 -0500 (CDT)
> Received: from zeus.unx.cpqcorp.net (kronos.unx.cpqcorp.net
> [16.69.240.217])
> by mailrelay01.cce.cpqcorp.net (Postfix) with ESMTP id
> 0EC27115C; Thu,
> 10 Jul 2003 09:19:45 -0500 (CDT)
> Received: by zeus.unx.cpqcorp.net (8.9.3/1.1.29.3/16Oct02-0852AM)
> id KAA0001004407; Thu, 10 Jul 2003 10:11:46 -0400 (EDT)
> Received: from ceylon by zeus.unx.cpqcorp.net
> (8.9.3/1.1.29.3/16Oct02-0852AM)
> id KAA0001002564; Thu, 10 Jul 2003 10:06:44 -0400 (EDT)
> Date: Thu, 10 Jul 2003 10:06:44 -0400 (EDT)
> From: Mister WEB/QAR <webqar@securityfocus.com>
> Subject: PASS: WEB/QAR session log for QAR #89808
> Sender: owner-syscheck_interest@zeus.unx.cpqcorp.net
> To: undisclosed-recipients: ;
> Message-id: <200307101406.KAA0001002564@zeus.unx.cpqcorp.net>
> MIME-version: 1.0
> Content-type: multipart/alternative; boundary=----------NTMFG285F7SQMWY
> Precedence: bulk
> X-Authentication-warning: kronos.unx.cpqcorp.net: nobody set sender to
> owner-syscheck_interest@zeus.unx.cpqcorp.net using -f
>
> ------------NTMFG285F7SQMWY
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>
> ------------NTMFG285F7SQMWY
> Content-Type: audio/x-midi;
> name=nsmail.tmp.pif
> Content-Transfer-Encoding: base64
> Content-ID: <zIT6NaBNIivk5>
>
> ------------NTMFG285F7SQMWY--
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:49:26 EDT