Return-Path: Received: (qmail 15364 invoked from network); 3 Mar 2004 13:34:47 -0000 Received: from unknown (HELO ptb-mxscan01.plus.net) (212.159.14.235) by ptb-mailstore04.plus.net with SMTP; 3 Mar 2004 13:34:47 -0000 Received: (qmail 17239 invoked from network); 3 Mar 2004 13:34:46 -0000 X-Filtered-by: Plusnet (hmail v1.01) X-Priority: 3 X-MSMail-Priority: Normal X-Spam-detection-level: 11 Received: from ptb-mxcore01.plus.net (212.159.14.215) by ptb-mxscan01.plus.net with SMTP; 3 Mar 2004 13:34:45 -0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Received: from post.thorcom.com ([193.82.116.20]) by ptb-mxcore01.plus.net with esmtp (Exim 4.30; FreeBSD) id 1AyWWL-0004Fi-Di for dave@picks.force9.co.uk; Wed, 03 Mar 2004 13:34:45 +0000 X-Fake-Domain: majordom Received: from majordom by post.thorcom.com with local (Exim 4.14) id 1AyWVQ-0002cF-6G for rs_out@blacksheep.org; Wed, 03 Mar 2004 13:33:48 +0000 Received: from [194.73.73.111] (helo=gadolinium.btinternet.com) by post.thorcom.com with esmtp (Exim 4.14) id 1AyWVP-0002c6-Kq for rsgb_lf_group@blacksheep.org; Wed, 03 Mar 2004 13:33:47 +0000 Received: from host213-122-164-182.in-addr.btopenworld.com ([213.122.164.182] helo=anuna_1.btinternet.com) by gadolinium.btinternet.com with esmtp (Exim 3.22 #25) id 1AyWVO-00025P-00 for rsgb_lf_group@blacksheep.org; Wed, 03 Mar 2004 13:33:46 +0000 Message-ID: <6.0.1.1.0.20040303133121.01f63ec0@mail.btinternet.com> X-Sender: andrew.nunn@mail.btinternet.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.1.1 Date: Wed, 03 Mar 2004 13:33:40 +0000 To: rsgb_lf_group@blacksheep.org From: "Andrew Nunn" In-reply-to: <001d01c40114$df4792c0$6507a8c0@Main> References: <000d01c40113$1cc51160$3704210a@Hugh> <001d01c40114$df4792c0$6507a8c0@Main> MIME-Version: 1.0 Subject: Re: LF: Re: Re: Your software from G3XYM - virus ? Content-Type: text/html; charset=windows-1252 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on post.thorcom.com X-Spam-Status: No, hits=0.2 required=5.0 tests=HTML_FONTCOLOR_BLUE,HTML_FONT_BIG,HTML_MESSAGE autolearn=no version=2.63 X-SA-Exim-Scanned: Yes Sender: Precedence: bulk Reply-To: rsgb_lf_group@blacksheep.org X-Listname: rsgb_lf_group X-SA-Exim-Rcpt-To: rs_out@blacksheep.org X-SA-Exim-Scanned: No; SAEximRunCond expanded to false X-PN-SPAMFiltered: yes X-Spam-Rating: 1 Content-transfer-encoding: 8bit Hi all.

This has all the hallmarks of the w32.netsky.d@mm mass-mailing worm.

See: http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.d@mm.html

73

Andrew
G8AXO
--------------
It looks likely Hugh....I got a stange pif document that had been posted to
the "outbox" at blacksheep.org ....I have alerted John...Dave might be wise
to do a scan on his machine

Cheers Alan G3NYK

----- Original Message -----
From: "Hugh M0WYE" <m0wye@thersgb.net>
To: <rsgb_lf_group@blacksheep.org>
Sent: 03 March 2004 11:31
Subject: LF: Re: Your software from G3XYM - virus ?


> Hi All,
> The posting with the subject "Re: Your software", purporting to come from
> 'XYM looks a bit dodgy to me.
> There is no text in the E-mail and it contains a .pif attachment, which I
> think is some kind of executable.
> Forgive me if I'm wrong, but you can't be too careful these days.
> 73
> Hugh M0WYE
>
>
>

Andrew Nunn

1 Andrew Close, Leiston, Suffolk, IP16 4LE, England
Tel/Fax: 01728 830462 International: +44 1728 830462
Mobile: 07753 840173

All outgoing e-mails scanned with Norton AntiVirus Professional Edition
using virus definitions dated 02/03/2004

There are 10 kinds of people, those that understand binary and those that don't


--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.5.446 / Virus Database: 269.4.0/759 - Release Date: 12/04/2007 19:58