RE: VIRUS ALERT, do not open attached ZIP file from Oracle-L memb er

From: Freeman Robert - IL <FREEMANR_at_tusc.com>
Date: Fri, 9 Jul 2004 13:35:11 -0500
Message-ID: <F5E885BEF9540D47A7BDC03CF1688087066D689D@tuscil_ex1>

Actually, it's pretty easy to spoof a mail message, all you need is an address. I've even seen spoofed messages that were not ligit addresses. I like the anti-spam software that returns a message to an unknown address and asks that it be verified before it even delivers the mail message.

RF  

-----Original Message-----
From: oracle-l-bounce_at_freelists.org
To: oracle-l_at_freelists.org
Sent: 7/9/2004 9:20 AM
Subject: RE: VIRUS ALERT, do not open attached ZIP file from Oracle-L member

Hi,

If I remember, it was long ago since I've seen it done, the spoofer might need access to the mail server host. Given access to the mail server host its trivial.

So, you might suggest to your SA that their mail server host access is compromised. And, worse than that it might be compromised by someone launching MS viruses (which might not alert on xNIX antivirus, if any).

The McAfee message log from the email says:

08/07/2004	9:37 PM	Deleted	W2KSERV123\Administrator
J:\temp\Cache\FC3999B4d01	W32/Bagle.gen!pwdzip
08/07/2004	9:37 PM	Deleted	W2KSERV123\Administrator

C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\olriiivt W32/Bagle.gen!pwdzip

HTH. Good luck catching up with them. :-)

Regards,

Mike

• "Goulet, Dick" <DGoulet_at_vicr.com> wrote:
  > Mike,
  >
  > You can easily assume that the mail message was
  > spoofed. Our mail =
  

  ---

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

---

Please see the official ORACLE-L FAQ: http://www.orafaq.com

---

To unsubscribe send email to: oracle-l-request_at_freelists.org put 'unsubscribe' in the subject line.

--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html
-----------------------------------------------------------------
----------------------------------------------------------------
Please see the official ORACLE-L FAQ: http://www.orafaq.com
----------------------------------------------------------------
To unsubscribe send email to:  oracle-l-request_at_freelists.org
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html
-----------------------------------------------------------------

Received on Fri Jul 09 2004 - 13:32:18 CDT