VIRUS-DISCUSSION-L Archives

Archiver > VIRUS-DISCUSSION > 2001-01 > 0978416185


From: "George W. Durman" <>
Subject: Re: [VIRUS] Snow white
Date: Tue, 02 Jan 2001 01:16:25 -0500
In-Reply-To: <003701c0746b$0f86f780$cd70453f@k7f2m8>


As you probably saw in an earlier post, someone who is a user of this
VIRUS-DISCUSSION Mailing List is infected with Snowhite. That user's
server is worldnet.att.net, but I would have to email the server and ask
them to try to find out which user sent it. Yes, the Reply To address is
filled in by the virus itself, but in the expanded headers, the user's
server can still be found. The reason I know that the infected person is a
user of this List is that Snowhite takes email addresses from the infected
person's email program and sends itself to those addresses. That means the
infected user has email from this List somewhere in his/her email program,
and/or has the List's email address in an address book. In either case,
the person either is a current user or a past user.

SgtGeorge

At 10:21 PM 01/01/2001, O.H. Barnes wrote:
*********START OF ORIGINAL MESSAGE TEXT*********
Just received snow white from ip address 216.226.31.83 which is Fullnet
Communications, Oklahoma City, OK.


==== VIRUS-DISCUSSION Mailing List ====
To unsubscribe:
Send to:
(to unsubscribe from the -L, individual email mode)
OR
Send to:
(to unsubscribe from the -D, Digest mode)
Subject Line: UNSUBSCRIBE
Body: UNSUBSCRIBE

==============================
Search more than 150 million free records at RootsWeb!
http://searches.rootsweb.com/
**********END OF ORIGINAL MESSAGE TEXT**********

This thread: