At 14:10 10/09/02 +1200, Juha Saarinen wrote:
Normally I wouldn't reply to this sort of thing on list, but I've already received about 10 replies to this message which I did *not* send.
Suuuuuuuure ;-)
<fwap> :)
Which begs an interesting question, why did Xtra's much-touted virus scanner let it through ? :)
Don't think it did.
------------------ Virus Warning Message ------------------
Found virus WORM_KLEZ.H in file 0px The uncleanable file is deleted.
-------------------------------------------------------------
Interesting, I don't see anything like that in the copy I received in Eudora. Just a line that said
Content-Type: text/html;
Even if I view the full message source there is no warning anything like
I found this message in the AV logs (note the envelope sender is not the same as the From: header...): 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: mail from xxx(a)xtra.co.nz, to nznog(a)list.waikato.ac.nz 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: scanning file email-body 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: email-body contains no virus 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: scanning file 0px Date: 09/10/2002 13:40:16 Method: SMTP From: xxx(a)xtra.co.nz To: nznog(a)list.waikato.ac.nz File: 0px Action: The uncleanable file is deleted. Virus: WORM_KLEZ.H ---------------------------------- 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: 0px contains a virus WORM_KLEZ.H 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: The uncleanable file is deleted. 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: scanning file ADSAdClient31 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: ADSAdClient31 contains no virus 09/10/2002 13:40:16 smtp[27032]: smtp[4040]: mail delivered from xxx(a)xtra.co.nz to nznog(a)list.waikato.ac.nz Cheers, Des ----- Original Message ----- From: "Simon Byrnand" <simon(a)igrin.co.nz> To: "Juha Saarinen" <nznog(a)list.waikato.ac.nz> Sent: Tuesday, September 10, 2002 2:26 PM Subject: Re: So cool a flash,enjoy it that.
Besides, I recieved warnings from other peoples virus scanners, not
Among them were "Marshal Integrated McAfee Antivirus", and "InoculateIT Ver 6.x".
For other peoples virus scanners to pick something up, then Xtra's - by definition - must have let something through. Whether what got let
Xtra's. through
was dangerous or not is another matter.
Or do you mean, why did it let the disinfected message through? Interesting question actually. Xtra probably decided not to stop them, so as not to interfere with Telecom's profitability^W^Wusers' email too much.
Good idea, lets just clean the virus off and pass the rest of the message including virus-attached private documents through. Oh wait, maybe thats not such a good idea afterall.... ;)
Regards, Simon
- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog