Klarinet Archive - Posting 000177.txt from 2004/03

From: Mark Gresham <mgresham@------.com>
Subj: Re: [kl] Virus
Date: Wed, 3 Mar 2004 17:13:44 -0500


Erik Tkal wrote:
> These types of viruses are usually a combination of script
> and executable, but require the cooperation of a carelessly configured
> email client to assist.

As well as a carelessly configured human recipient. ;-)

Seriously, several specific virus-laden e-mails that have come to me in
the past few days in a message format to watch out for:

1) spoofs "From:" as an often bogus "offical" address at your [domain]
(like "staff@------.com") and a mangled message ID in the header;
2) includes the lines "The [domain] team" and a legit link to the
[domain] website (this is the consistent part);
3) has an attachment that is a zip file;
4) poses as a virus warning that asks you to open the attachment.

Number (2) is the distinguishing "thumbprint" of this particular one.

It *almost* fooled a couple of otherwise very experienced people I know.

--
--
Mark Gresham, composer
mgresham@------.com http://www.markgresham.com/
Lux Nova Press http://www.luxnova.com/
LNP Retail Webstore http://www.luxnova.com/lnpwebstore/