[email] WARNING: YOU MAY HAVE A VIRUS
NANASreport+$do-no...@gwalter.demon.co.uk
addresses belonging to this site (E&OE). HTML has been doctored as follows,
to prevent usable hotlinks or rendering in newsreaders that do such things:
1) http:// has been replaced by $http$:||
2) < has been replaced by {
3) / has been replaced by |
NB ISPs mentioned below received _unmunged_ copies
ie the munging is only done for posting to NANAS.
Copied to boss-truck.com for spurious notification
Sender information in original email is forged
Sender information in original email is forged - most viruses do this. Netsky certainly does
Please fix your virus checker to not send out these spurious messages
Copied to francetelecom.com for 193.251.169.170
Copied to Declude.com for the spurious notification from Declude Virus software
Note: Unsolicited Commercial Email to this address contravenes UK Law,
as does any Commercial Email which conceals the identity of the sender,
or does not provide a valid opt-out address.
#############################################################################
## Contents of Email, converted/rendered where possible ##
#############################################################################
===================================================================================
ASCII mail text
===================================================================================
The Declude Virus software on boss-truck.com has reported that you
sent an E-mail to ba...@boss-truck.com, containing the W32|Netsky.D@mm virus in the
document_4351.pif attachment. The subject of the E-mail was "Re: Re: Re: Your document".
The E-mail containing the virus has been quarantined to prevent further damage.
Headers Follow:
#############################################################################
## Complete Email, with Headers ##
#############################################################################
From postm...@boss-truck.com Tue May 4 09:55:38 2004
Return-Path: {postm...@boss-truck.com>
Received: from localhost (root@localhost [127.0.0.1])
by jupiter.$munged$.demon.co.uk (8.12.9-20030917|8.12.9) with ESMTP id i448t68R022161
for {$munged$@$munged$.demon.co.uk>; Tue, 4 May 2004 09:55:38 +0100
Received: from pop3.demon.co.uk
by localhost with POP3 (fetchmail-6.2.1)
for $munged$@$munged$.demon.co.uk (multi-drop); Tue, 04 May 2004 09:55:38 +0100 (BST)
Received: from punt-3.mail.demon.net by mailstore
for $munged$@$munged$.demon.co.uk id 1BKvVi-0002Fs-Mn;
Tue, 04 May 2004 08:42:42 +0000
Received: from [194.217.242.223] (helo=lon1-hub.mail.demon.net)
by punt-3.mail.demon.net with esmtp id 1BKvVi-0002Fs-Mn
for $munged$@$munged$.demon.co.uk; Tue, 04 May 2004 08:42:42 +0000
Received: from [208.34.50.132] (helo=boss-truck.com)
by lon1-hub.mail.demon.net with esmtp id 1BKvVh-0007aw-Ne
for $munged$@$munged$.demon.co.uk; Tue, 04 May 2004 08:42:41 +0000
Date: Tue, 4 May 2004 04:42:38 -0400
Message-Id: {200405040442...@boss-truck.com>
Mime-Version: 1.0
Content-Type: text|plain; charset=us-ascii
From: "Postmaster" {postm...@boss-truck.com>
Reply-To: {postm...@boss-truck.com>
Subject: WARNING: YOU MAY HAVE A VIRUS
X-Mailer: {IMail v8.10>
X-SpamType:
X-Domains: boss-truck.com declude.com francetelecom.com
To: $munged$
The Declude Virus software on boss-truck.com has reported that you
sent an E-mail to ba...@boss-truck.com, containing the W32|Netsky.D@mm virus in the
document_4351.pif attachment. The subject of the E-mail was "Re: Re: Re: Your document".
The E-mail containing the virus has been quarantined to prevent further damage.
Headers Follow:
Received: from boss-truck.com [193.251.169.170] by mail.cydian.com with ESMTP
(SMTPD32-8.10) id A760C000074; Tue, 04 May 2004 04:42:08 -0400
From: $munged$@$munged$.demon.co.uk
To: ba...@boss-truck.com
Subject: Re: Re: Re: Your document
Date: Tue, 4 May 2004 10:42:13 +0200
MIME-Version: 1.0
Content-Type: multipart|mixed;
boundary="----=_NextPart_000_0014_00003092.00004DD1"
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: {20040504044...@boss-truck.com>
--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.
For a copy of the guidelines to this group, see:
<URL:http://www.killfile.org/~tskirvin/nana/>