[XviD-devel] Illegal attachment type found in sent message"Core library Related Pages"

[Christoph Lampert]

On Wed, 19 Mar 2003, Klaus Post (KPO) wrote:

> Isn't this just a matter of somebody attaching a file with the ".scr"
> extension, and therefore automatically being rejected by the AV-filter. 


No. Nobody on this list attaches a ".scr" file. Why should anyone? 
It's simply a stupid virus that forges the sender address to something
from the address book, in this case Skal, and sends itself as some kind of
executable attachement (pif/exe/scr) to another address, in this case
xvid-devel. This happened before, it's always the same method. 
The subject is generated out of some text-file or email, in this case 
from XVID API document. The mail body itself is empty or almost empty. 

Virus' like this I get sent a lot these days. If you have one they are
easy to remove with the right tools, but you have to know who is infected,
and that isn't easy to find out (because all addresses are faked). 

gruel

P.S. It's not me, I'm a pure Linux user. 


> 
>  
> Regards, Klaus Post
> Producer
>  
>  
> -----Original Message-----
> From: Christoph Lampert [mailto:chl at math.uni-bonn.de] 
> Sent: 19. marts 2003 13:25
> To: xvid-devel at xvid.org
> Subject: Re: [XviD-devel] Illegal attachment type found in sent
> message"Core library Related Pages"
> 
> 
> Hi,
> 
> can please all Windows users on this list check again if they 
> have a virus? All these faked mails with virus attachement get 
> somehow annoying. 
> 
> gruel 
> 
> 
> 
> 
> On 19 Mar 2003, it was written:
> 
> > Attention: xvid-devel <xvid-devel at xvid.org>.
> > 
> > 
> > A Illegal attachment type was found in an Email message you sent. 
> > This Email scanner intercepted it and stopped the entire message
> > reaching it's destination. 
> > 
> > The Illegal attachment type was reported to be: 
> > 
> > ScreenSavers Disallowed (force by changing the extension)
> > 
> > 
> > Please contact your I.T support personnel with any queries regarding
> this 
> > policy.
> > 
> > 
> > Your message was sent with the following envelope:
> > 
> > MAIL FROM: xvid-devel at xvid.org
> > RCPT TO:   skal at planet-d.net 
> > 
> > ... and with the following headers:
> > 
> > From:    xvid-devel <xvid-devel at xvid.org>
> > To:      skal at planet-d.net
> > Subject: Core library Related Pages
> > Message-ID:
> <E18vcKc-00065M-6v.2003-03-19-12-06-06 at tmailm1.svr.pol.co.uk>
> > Date:    Wed, 19 Mar 2003 12:06:06 +0000
> > 
> > 
> > 
> > The original message is kept in:
> > 
> >   ace:/var/spool/qmailscan/quarantine
> > 
> > where the System Anti-Virus Administrator can further diagnose it.
> > 
> > The Email scanner reported the following when it scanned that message:
> > 
> > --- 
> > 
> > ---perlscanner results ---
> > Illegal attachment type 'ScreenSavers Disallowed (force by changing
> the extension)' found in file
> /var/spool/qmailscan/ace104807499920511/2002.scr
> > ---
> > _______________________________________________
> > XviD-devel mailing list
> > XviD-devel at xvid.org
> > http://list.xvid.org/mailman/listinfo/xvid-devel
> > 
> 
> 
> _______________________________________________
> XviD-devel mailing list
> XviD-devel at xvid.org
> http://list.xvid.org/mailman/listinfo/xvid-devel
> 
> _______________________________________________
> XviD-devel mailing list
> XviD-devel at xvid.org
> http://list.xvid.org/mailman/listinfo/xvid-devel
>