|
Re: malware email - Sobig
|
ia-@iankingston.com
|
Oct 23, 2003 23:36 PDT
|
jsampson+indexes wrote:
| | The ones coming here have all had '.zlo' file endings. I don't know what
legitimate application uses/produces files with that ending. If I had a
filter that zapped email with '.zlo' attachments I would have my answer.
But in any case, when would a legitimate 'bounce' notification have an
attachment?
|
Because the clueless admin of the system generating the bounce has it
set up that way. Sobig's propagation was considerably aided by this
piece of stupidity, as the bounced messages went to the forged 'From'
addresses, resulting in Sobig being sent to even more people.
--
|| Ian Kingston: Editing and Typesetting ||
|| ia-@iankingston.com ||
|
|
 |
|
