Virus in BlackBox Mails

From: Zinn, Helmut <"Zinn,>
Date: Tue, 25 Jun 2002 07:52:50 +0200

----boundary-LibPST-iamunique-1713401429_-_-
Content-type: text/plain

Dear BlackBox mailinglist readers

I received 3 mails via the BlackBox mailinglist including a virus.

The subjects are

        1. Look,my beautiful girl friend
        2.
        3. Hi,blackbox,how are you

Regards

Helmut

Appendix: The message from the mailsweeper:

Virus gefunden in der Mail von blackbox-request{([at]})nowhere.xy
Helmut.Zinn{([at]})nowhere.xy
 am Mon, 24 Jun 2002 13:37:15 -0400 (VET). Der Virus konnte nicht beseitigt
werden aus folgendem Grund:

Scenarios/Incoming/FileBlocker: A filename matching the file mask was
detected: 'setuplog.scr'.
Scenarios/Incoming/Sophos-AV: A virus has been detected: 'W32/Klez-H'.
Scenarios/Incoming/Block Exe: 'ItemLength.GE.0'.

Virus gefunden in der Mail von blackbox-request{([at]})nowhere.xy
Helmut.Zinn{([at]})nowhere.xy
 am Mon, 24 Jun 2002 14:37:44 -0400 (VET). Der Virus konnte nicht beseitigt
werden aus folgendem Grund:

Scenarios/Incoming/FileBlocker: A filename matching the file mask was
detected: 'dif.pif'.
Scenarios/Incoming/Sophos-AV: A virus has been detected: 'W32/Klez-H'.
Scenarios/Incoming/Block Exe: 'ItemLength.GE.0'.

Virus gefunden in der Mail von blackbox-request{([at]})nowhere.xy
Helmut.Zinn{([at]})nowhere.xy
 am Mon, 24 Jun 2002 13:37:15 -0400 (VET). Der Virus konnte nicht beseitigt
werden aus folgendem Grund:

Scenarios/Incoming/FileBlocker: A filename matching the file mask was
detected: 'setuplog.scr'.
Scenarios/Incoming/Sophos-AV: A virus has been detected: 'W32/Klez-H'.
Scenarios/Incoming/Block Exe: 'ItemLength.GE.0'.

--------------------------------------------

To unsubscribe from this mailing list, send a message containing the word "unsubscribe" to:
   blackbox-request{([at]})nowhere.xy

To get a list of valid e-mail commands and instructions on their usage, send a message containing the word "help" to the above address.

Send any problem reports or questions related to this email list to the list owner at
   owner-blackbox{([at]})nowhere.xy

Current posting policy:

a) To post you should use the same address by which you are subscribed to the mailing list. That way, the list server will recognize you as subscriber and forward your posting immediately, without creating any overhead.

b) If, for some reason, you cannot post from the address, by which you are subscribed, your message will be moderated to avoid spam. Please understand that moderation will often cause some delay, in particular over weekends or holydays.

----boundary-LibPST-iamunique-1713401429_-_-
Content-type: application/rtf
Content-transfer-encoding: base64
Content-Disposition: attachment; filename="rtf-body.rtf"

e1xydGYxXGFuc2lcYW5zaWNwZzEyNTJcZnJvbXRleHQgXGRlZmYwe1xmb250dGJsDQp7XGYwXGZz
d2lzcyBBcmlhbDt9DQp7XGYxXGZtb2Rlcm4gQ291cmllciBOZXc7fQ0Ke1xmMlxmbmlsXGZjaGFy
c2V0MiBTeW1ib2w7fQ0Ke1xmM1xmbW9kZXJuXGZjaGFyc2V0MCBDb3VyaWVyIE5ldzt9fQ0Ke1xj
b2xvcnRibFxyZWQwXGdyZWVuMFxibHVlMDtccmVkMFxncmVlbjBcYmx1ZTI1NTt9DQpcdWMxXHBh
cmRccGxhaW5cZGVmdGFiMzYwIFxmMFxmczIwIERlYXIgQmxhY2tCb3ggbWFpbGluZ2xpc3QgcmVh
ZGVyc1xwYXINClxwYXINCkkgcmVjZWl2ZWQgMyBtYWlscyB2aWEgdGhlIEJsYWNrQm94IG1haWxp
bmdsaXN0IGluY2x1ZGluZyBhIHZpcnVzLlxwYXINClxwYXINClRoZSBzdWJqZWN0cyBhcmVccGFy
DQpccGFyDQpcdGFiIDEuIExvb2ssbXkgYmVhdXRpZnVsIGdpcmwgZnJpZW5kXHBhcg0KXHRhYiAy
LlxwYXINClx0YWIgMy4gSGksYmxhY2tib3gsaG93IGFyZSB5b3VccGFyDQpccGFyDQpSZWdhcmRz
XHBhcg0KXHBhcg0KSGVsbXV0XHBhcg0KXHBhcg0KQXBwZW5kaXg6IFRoZSBtZXNzYWdlIGZyb20g
dGhlIG1haWxzd2VlcGVyOlxwYXINClxwYXINClZpcnVzIGdlZnVuZGVuIGluIGRlciBNYWlsIHZv
biBibGFja2JveC1yZXF1ZXN0QG9iZXJvbi5jaCBhblxwYXINCkhlbG11dC5aaW5uQGlnbWV0YWxs
LmRlXHBhcg0KIGFtIE1vbiwgMjQgSnVuIDIwMDIgMTM6Mzc6MTUgLTA0MDAgKFZFVCkuIERlciBW
aXJ1cyBrb25udGUgbmljaHQgYmVzZWl0aWd0XHBhcg0Kd2VyZGVuIGF1cyBmb2xnZW5kZW0gR3J1
bmQ6XHBhcg0KXHBhcg0KU2NlbmFyaW9zL0luY29taW5nL0ZpbGVCbG9ja2VyOiBBIGZpbGVuYW1l
IG1hdGNoaW5nIHRoZSBmaWxlIG1hc2sgd2FzXHBhcg0KZGV0ZWN0ZWQ6ICdzZXR1cGxvZy5zY3In
LlxwYXINClNjZW5hcmlvcy9JbmNvbWluZy9Tb3Bob3MtQVY6IEEgdmlydXMgaGFzIGJlZW4gZGV0
ZWN0ZWQ6ICdXMzIvS2xlei1IJy5ccGFyDQpTY2VuYXJpb3MvSW5jb21pbmcvQmxvY2sgRXhlOiAn
SXRlbUxlbmd0aC5HRS4wJy5ccGFyDQpccGFyDQpWaXJ1cyBnZWZ1bmRlbiBpbiBkZXIgTWFpbCB2
b24gYmxhY2tib3gtcmVxdWVzdEBvYmVyb24uY2ggYW5ccGFyDQpIZWxtdXQuWmlubkBpZ21ldGFs
bC5kZVxwYXINCiBhbSBNb24sIDI0IEp1biAyMDAyIDE0OjM3OjQ0IC0wNDAwIChWRVQpLiBEZXIg
VmlydXMga29ubnRlIG5pY2h0IGJlc2VpdGlndFxwYXINCndlcmRlbiBhdXMgZm9sZ2VuZGVtIEdy
dW5kOlxwYXINClxwYXINClNjZW5hcmlvcy9JbmNvbWluZy9GaWxlQmxvY2tlcjogQSBmaWxlbmFt
ZSBtYXRjaGluZyB0aGUgZmlsZSBtYXNrIHdhc1xwYXINCmRldGVjdGVkOiAnZGlmLnBpZicuXHBh
cg0KU2NlbmFyaW9zL0luY29taW5nL1NvcGhvcy1BVjogQSB2aXJ1cyBoYXMgYmVlbiBkZXRlY3Rl
ZDogJ1czMi9LbGV6LUgnLlxwYXINClNjZW5hcmlvcy9JbmNvbWluZy9CbG9jayBFeGU6ICdJdGVt
TGVuZ3RoLkdFLjAnLlxwYXINClxwYXINClZpcnVzIGdlZnVuZGVuIGluIGRlciBNYWlsIHZvbiBi
bGFja2JveC1yZXF1ZXN0QG9iZXJvbi5jaCBhblxwYXINCkhlbG11dC5aaW5uQGlnbWV0YWxsLmRl
XHBhcg0KIGFtIE1vbiwgMjQgSnVuIDIwMDIgMTM6Mzc6MTUgLTA0MDAgKFZFVCkuIERlciBWaXJ1
cyBrb25udGUgbmljaHQgYmVzZWl0aWd0XHBhcg0Kd2VyZGVuIGF1cyBmb2xnZW5kZW0gR3J1bmQ6
XHBhcg0KXHBhcg0KU2NlbmFyaW9zL0luY29taW5nL0ZpbGVCbG9ja2VyOiBBIGZpbGVuYW1lIG1h
dGNoaW5nIHRoZSBmaWxlIG1hc2sgd2FzXHBhcg0KZGV0ZWN0ZWQ6ICdzZXR1cGxvZy5zY3InLlxw
YXINClNjZW5hcmlvcy9JbmNvbWluZy9Tb3Bob3MtQVY6IEEgdmlydXMgaGFzIGJlZW4gZGV0ZWN0
ZWQ6ICdXMzIvS2xlei1IJy5ccGFyDQpTY2VuYXJpb3MvSW5jb21pbmcvQmxvY2sgRXhlOiAnSXRl
bUxlbmd0aC5HRS4wJy5ccGFyDQpccGFyDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLVxwYXINClxwYXINClRvIHVuc3Vic2NyaWJlIGZyb20gdGhpcyBtYWlsaW5n
IGxpc3QsIHNlbmQgYSBtZXNzYWdlIGNvbnRhaW5pbmcgdGhlIHdvcmQgInVuc3Vic2NyaWJlIiB0
bzpccGFyDQogICBibGFja2JveC1yZXF1ZXN0QG9iZXJvbi5jaFxwYXINClxwYXINClRvIGdldCBh
IGxpc3Qgb2YgdmFsaWQgZS1tYWlsIGNvbW1hbmRzIGFuZCBpbnN0cnVjdGlvbnMgb24gdGhlaXIg
dXNhZ2UsIHNlbmQgYSBtZXNzYWdlIGNvbnRhaW5pbmcgdGhlIHdvcmQgImhlbHAiIHRvIHRoZSBh
Ym92ZSBhZGRyZXNzLlxwYXINClxwYXINClNlbmQgYW55IHByb2JsZW0gcmVwb3J0cyBvciBxdWVz
dGlvbnMgcmVsYXRlZCB0byB0aGlzIGVtYWlsIGxpc3QgdG8gdGhlIGxpc3Qgb3duZXIgYXRccGFy
DQogICBvd25lci1ibGFja2JveEBvYmVyb24uY2hccGFyDQpccGFyDQpDdXJyZW50IHBvc3Rpbmcg
cG9saWN5OlxwYXINClxwYXINCmEpIFRvIHBvc3QgeW91IHNob3VsZCB1c2UgdGhlIHNhbWUgYWRk
cmVzcyBieSB3aGljaCB5b3UgYXJlIHN1YnNjcmliZWQgdG8gdGhlIG1haWxpbmcgbGlzdC4gVGhh
dCB3YXksIHRoZSBsaXN0IHNlcnZlciB3aWxsIHJlY29nbml6ZSB5b3UgYXMgc3Vic2NyaWJlciBh
bmQgZm9yd2FyZCB5b3VyIHBvc3RpbmcgaW1tZWRpYXRlbHksIHdpdGhvdXQgY3JlYXRpbmcgYW55
IG92ZXJoZWFkLlxwYXINClxwYXINCmIpIElmLCBmb3Igc29tZSByZWFzb24sIHlvdSBjYW5ub3Qg
cG9zdCBmcm9tIHRoZSBhZGRyZXNzLCBieSB3aGljaCB5b3UgYXJlIHN1YnNjcmliZWQsIHlvdXIg
bWVzc2FnZSB3aWxsIGJlIG1vZGVyYXRlZCB0byBhdm9pZCBzcGFtLiBQbGVhc2UgdW5kZXJzdGFu
ZCB0aGF0IG1vZGVyYXRpb24gd2lsbCBvZnRlbiBjYXVzZSBzb21lIGRlbGF5LCBpbiBwYXJ0aWN1
bGFyIG92ZXIgd2Vla2VuZHMgb3IgaG9seWRheXMuXHBhcg0KfQ==


----boundary-LibPST-iamunique-1713401429_-_---
Received on Tue Jun 25 2002 - 07:52:50 UTC