Re: virus Re: Questionnaire

[Michael Talbot-Wilson]

Ye 2003-05-19 19:05 -0600, D. Stimits skribis:
> Thomas E. Dickey wrote:
> > On Mon, 19 May 2003, D. Stimits wrote:
> > >The "questionnaire" is really a windows virus.
> > I didn't approve any mailing-list stuff today (there were perhaps 20-30

> realistic). I've deleted the virus email, so I can't look closer, but it

If it is of interest, here is part of the headers (apologies to those
who still have it or don't care).

(etc)
Received: from list by monty-python.gnu.org with tmda-scanned (Exim 4.10.13)
        id 19HsCD-0004ex-00
        for address@hidden; Mon, 19 May 2003 17:29:25 -0400
Received: from mail by monty-python.gnu.org with spam-scanned (Exim 4.10.13)
        id 19Hs1p-0001py-00
        for address@hidden; Mon, 19 May 2003 17:18:44 -0400
Received: from sc005pub.verizon.net ([206.46.170.181])
        by monty-python.gnu.org with esmtp (Exim 4.10.13)
        id 19HqSB-0006aw-00
        for address@hidden; Mon, 19 May 2003 15:37:47 -0400
Received: from [43.244.201.19] (port=16421 helo=Jovyx)
        by sc005pub.verizon.net with smtp (Exim 4.14)
        id 19HqS0-000165-Fk
        for address@hidden; Mon, 19 May 2003 14:37:36 -0500
From: dickey <address@hidden>

The MIME of the attachment looks like this:

> --G6M649WmP6FmT5Vtyz3313P3CfJ8
> Content-Type: audio/x-wav;
>         name=type to.exe
> Content-Transfer-Encoding: base64
> Content-ID: <X936G9ZQ4A6Y>

The attachment contains the strings, "This program cannot be run in
DOS mode", "Microsoft Visual C++ Runtime Library", "HELO %s", "MAIL
FROM:", "RCPT TO:", "DATA", and "This program must be run under
Win32".