[PHP] Tales of brave Ulysses?

2002-07-15 Thread Alberto Serra

ðÒÉ×ÅÔ!

I just got this. Not sure whether it's the stupidest commercial I ever 
seen or a new virus (as you see in the headers it stepped thru the check 
with no warnings), or just a joke.

I'd say it's a joke, as nobody would add anything clearly stating itself 
as "decrypt-password.exe", but I will not make any experiments on my box.

Looks like it didn't have any effect on a text-based email running on a 
Linux box, but those of you running Windows might be careful in opening 
any such stuff. I'll never have HTML enabled on email mainly because of 
this.

ÐÏËÁ
áÌØÂÅÒÔÏ
ëÉÅ×

---

 From - Mon Jul 15 12:20:25 2002
X-UIDL: 2828
X-Mozilla-Status: 0011
X-Mozilla-Status2: 
Return-Path: <[EMAIL PROTECTED]>
X-Sieve: cmu-sieve 2.0
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Mon, 15 Jul 2002 07:54:27 +0300
Received: from avcheck by mail.gala.net with antivirus-scanned (Exim 
3.22 (GalaMail))
id 17TxsR-0001za-00
 for <[EMAIL PROTECTED]>; Mon, 15 Jul 2002 07:54:27 +0300
Received: from ns.gala.net ([194.183.188.131] helo=relay.gala.net)
by mail.gala.net with esmtp (Exim 3.22 (GalaMail))
id 17TxsQ-0001z6-00
 for <[EMAIL PROTECTED]>; Mon, 15 Jul 2002 07:54:26 +0300
Received: from public-smtp.telkom.net.id ([202.134.0.35] 
helo=out-mta2.plasa.com)
by relay.gala.net with esmtp (Exim 3.35 (GalaMail))
id 17TxSm-0004ON-00
 for <[EMAIL PROTECTED]>; Mon, 15 Jul 2002 07:27:58 +0300
Received: from smtp.telkom.co.id ([192.168.17.123])
by out-mta2.plasa.com with esmtp (Exim 4.02)
id 17TxMG-000tqP-00
for [EMAIL PROTECTED]; Mon, 15 Jul 2002 11:21:12 +0700
Received: from web3.telkom.co.id ([192.168.17.34] helo=AFRICA)
by smtp.telkom.co.id with smtp (Exim 4.02)
id 17TxFT-0005yx-00
for [EMAIL PROTECTED]; Mon, 15 Jul 2002 11:14:11 +0700
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Re: Your password!
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=L1db82sd319dm2ns0f4383dhG
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 15 Jul 2002 11:14:11 +0700
X-Envelope-To: [EMAIL PROTECTED]

--L1db82sd319dm2ns0f4383dhG
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable



ATTENTION!
You can access
very important
information by
this password
DO NOT SAVE
password to disk
use your mind
now press
cancel
(Charindra P)
cid:W8dqwq8q918213 height=3D0 width=3D0>

--L1db82sd319dm2ns0f4383dhG
Content-Type: audio/x-midi;
name=decrypt-password.exe
Content-Transfer-Encoding: base64
Content-ID: 

here it followed the decrypt-password.exe code...


@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@

LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu?
lOrD i'M sHiNiNg...
YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE
tHe TeSt, YeS iT iS
ThE tEsT, yEs It Is
tHe TeSt, YeS iT iS
ThE tEsT, yEs It Is...


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Tales of brave Ulysses?

2002-07-15 Thread Chris Hewitt

Alberto Serra wrote:

> !
>
> I just got this. Not sure whether it's the stupidest commercial I ever 
> seen or a new virus (as you 

I got one too. I guess we have an email harvester? As I'm on linux I 
could not try the executable anyway but I would not execute it if I was 
on windows either.

Chris


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Tales of brave Ulysses?

2002-07-15 Thread Bret L Conard

I received it to, but it *did* trigger my virus warning.
Just deleted and moved on : )
Bret

- Original Message -
From: "Alberto Serra" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Monday, July 15, 2002 5:52 AM
Subject: [PHP] Tales of brave Ulysses?


> ðÒÉ×ÅÔ!
>
> I just got this. Not sure whether it's the stupidest commercial I ever
> seen or a new virus (as you see in the headers it stepped thru the check
> with no warnings), or just a joke.
>
> I'd say it's a joke, as nobody would add anything clearly stating itself
> as "decrypt-password.exe", but I will not make any experiments on my box.
>
> Looks like it didn't have any effect on a text-based email running on a
> Linux box, but those of you running Windows might be careful in opening
> any such stuff. I'll never have HTML enabled on email mainly because of
> this.
>
> ÐÏËÁ
> áÌØÂÅÒÔÏ
> ëÉÅ×
>
> ---
>
>  From - Mon Jul 15 12:20:25 2002
> X-UIDL: 2828
> X-Mozilla-Status: 0011
> X-Mozilla-Status2: 
> Return-Path: <[EMAIL PROTECTED]>
> X-Sieve: cmu-sieve 2.0
> Return-path: <[EMAIL PROTECTED]>
> Envelope-to: [EMAIL PROTECTED]
> Delivery-date: Mon, 15 Jul 2002 07:54:27 +0300
> Received: from avcheck by mail.gala.net with antivirus-scanned (Exim
> 3.22 (GalaMail))
> id 17TxsR-0001za-00
> for <[EMAIL PROTECTED]>; Mon, 15 Jul 2002 07:54:27 +0300
> Received: from ns.gala.net ([194.183.188.131] helo=relay.gala.net)
> by mail.gala.net with esmtp (Exim 3.22 (GalaMail))
> id 17TxsQ-0001z6-00
> for <[EMAIL PROTECTED]>; Mon, 15 Jul 2002 07:54:26 +0300
> Received: from public-smtp.telkom.net.id ([202.134.0.35]
> helo=out-mta2.plasa.com)
> by relay.gala.net with esmtp (Exim 3.35 (GalaMail))
> id 17TxSm-0004ON-00
> for <[EMAIL PROTECTED]>; Mon, 15 Jul 2002 07:27:58 +0300
> Received: from smtp.telkom.co.id ([192.168.17.123])
> by out-mta2.plasa.com with esmtp (Exim 4.02)
> id 17TxMG-000tqP-00
> for [EMAIL PROTECTED]; Mon, 15 Jul 2002 11:21:12 +0700
> Received: from web3.telkom.co.id ([192.168.17.34] helo=AFRICA)
> by smtp.telkom.co.id with smtp (Exim 4.02)
> id 17TxFT-0005yx-00
> for [EMAIL PROTECTED]; Mon, 15 Jul 2002 11:14:11 +0700
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> Subject: Re: Your password!
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=L1db82sd319dm2ns0f4383dhG
> Message-Id: <[EMAIL PROTECTED]>
> Date: Mon, 15 Jul 2002 11:14:11 +0700
> X-Envelope-To: [EMAIL PROTECTED]
>
> --L1db82sd319dm2ns0f4383dhG
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>
> 
> 
> ATTENTION!
> You can access
> very important
> information by
> this password
> DO NOT SAVE
> password to disk
> use your mind
> now press
> cancel
> (Charindra P)
> cid:W8dqwq8q918213 height=3D0 width=3D0>
>
> --L1db82sd319dm2ns0f4383dhG
> Content-Type: audio/x-midi;
> name=decrypt-password.exe
> Content-Transfer-Encoding: base64
> Content-ID: 
>
> here it followed the decrypt-password.exe code...
>
>
> @-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@-_=}{=_-@
>
> LoRd, CaN yOu HeAr Me, LiKe I'm HeArInG yOu?
> lOrD i'M sHiNiNg...
> YoU kNoW I AlMoSt LoSt My MiNd, BuT nOw I'm HoMe AnD fReE
> tHe TeSt, YeS iT iS
> ThE tEsT, yEs It Is
> tHe TeSt, YeS iT iS
> ThE tEsT, yEs It Is...
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php