On Jun 17, 15:49, Joe R. wrote:
> I just got the message below from my ISP (Road Runner). It appears
that
> a message from the CC List contained Zafi.B worm.
That doesn't seem very likely, Joe. First of all, the mailing list
won't send attachments, yet the report you got says the worm was in an
attachment which was therefore removed. Secondly, they say the mail
came "From: Classiccmp <classiccmp_at_classiccmp.org>" The mailing list
never sends a header like that. The mail currently comes with an
envelope "From" (no colon) of "cctalk-bounces_at_classiccmp.org" which
contains no other name, and always claims to be "From:" (header
"From:", with a colon) the original poster.
What your ISP has reported on apeears to have had headers forged by the
sender, and didn't come from the list. It may have come from some
listmember's own machine, or at least an infected machine with
"classiccmp_at_classiccmp.org" in an addressbook, but not the list.
--
Pete Peter Turnbull
Network Manager
University of York
Received on Thu Jun 17 2004 - 15:59:35 BST