Message-ID: <001301c4015d$ba815180$1f00a8c0@dellboy>
From: "Dave Pick" <dave@picks.force9.co.uk>
To: rsgb_lf_group@blacksheep.org
References: <000d01c40113$1cc51160$3704210a@Hugh> <001d01c40114$df4792c0$6507a8c0@Main> <6.0.1.1.0.20040303133121.01f63ec0@mail.btinternet.com>
Date: Wed, 3 Mar 2004 20:25:53 -0000
MIME-Version: 1.0
Subject: Re: LF: Re: Re: Your software from G3XYM - virus ?
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Sender: <owner-rsgb_lf_group@blacksheep.org>
Precedence: bulk
Reply-To: rsgb_lf_group@blacksheep.org

Damn clever these viruses, they send e-mails without your machine being
switched on! ;-)
Yes it did look like Netsky, mails with that one seem to total about 25k.
What has to be borne in mind is that the "From" address on the virus mail is
as bogus as the Subject, it is picked at random from the affected machine's
address book. As most of us don't tend to have our own address in our
address books it seems that whoever appears to have sent the mail is
probably the least likely one to have actually done it!
Who'd be daft enough to run a ".pif" attachment anyway? Surely no-one on
this list???

Dave (computer in perfect health) G3YXM.


----- Original Message ----- 
From: Andrew Nunn
To: rsgb_lf_group@blacksheep.org
Sent: Wednesday, March 03, 2004 1:33 PM
Subject: Re: LF: Re: Re: Your software from G3XYM - virus ?


Hi all.

This has all the hallmarks of the w32.netsky.d@mm mass-mailing worm.

See:
http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.d@mm.html

73

Andrew
G8AXO
--------------

It looks likely Hugh....I got a stange pif document that had been posted to
the "outbox" at blacksheep.org ....I have alerted John...Dave might be wise
to do a scan on his machine

Cheers Alan G3NYK

----- Original Message -----
From: "Hugh M0WYE" <m0wye@thersgb.net>
To: <rsgb_lf_group@blacksheep.org>
Sent: 03 March 2004 11:31
Subject: LF: Re: Your software from G3XYM - virus ?


> Hi All,
> The posting with the subject "Re: Your software", purporting to come from
> 'XYM looks a bit dodgy to me.
> There is no text in the E-mail and it contains a .pif attachment, which I
> think is some kind of executable.
> Forgive me if I'm wrong, but you can't be too careful these days.
> 73
> Hugh M0WYE
>
>
>
Andrew Nunn

1 Andrew Close, Leiston, Suffolk, IP16 4LE, England
Tel/Fax: 01728 830462 International: +44 1728 830462
Mobile: 07753 840173

All outgoing e-mails scanned with Norton AntiVirus Professional Edition
using virus definitions dated 02/03/2004

There are 10 kinds of people, those that understand binary and those that
don't