[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Who is this virus sender????

On Tue, Nov 14, 2000 at 06:45:54PM -0200, Allan F. Caetano wrote:
> >>>>> "Antonio" == Antonio Rodriguez <arodriguez@worldnet.att.net> writes:
>     Antonio> The truth is that it is very starnge having a person sending over 20
>     Antonio> messages to the list, all infected...
>     Antonio> I have never seen that before.
>     I agree that it looks very strange, and the fact that Mr. Hsiang
> posted actually *helpful* tips in a very short time interval makes it
> look even stranger and a little saddening.

Oh, not really.  Read up on the worm.  He didn't post any of those
messages, the worm did.  He didn't even write the content, it was from
other posters.

For example, this one:

| Date: Tue, 14 Nov 2000 12:05:02 +0800
| From: "H.C.Hsiang" <hchsiang@tpts4.seed.net.tw>
| Subject: Re: which sound configuration utility?
| To: "Kenneth Scharf" <scharkalvin@yahoo.com>
| Cc: <debian-user@lists.debian.org>
| X-Mailer: Microsoft Outlook Express 5.50.4522.1200
| Message-ID: <021701c04df0$079ad010$4178738c@ss.ncu.edu.tw>
| On Thu, Apr 27, 2000 at 04:53:35AM -0700, Kenneth Scharf wrote:


Was originally posted to the list on Apr 27, 2000 by Ethan Benson (see
http://lists.debian.org/debian-user-0004/msg02401.html for the
original).  The worm dug it out of the mailbox and resubmitted it to the

Any perceived helpfulness in the posts was because the content was
stolen from other posts.

CueCat decoder .signature by Larry Wall:
#!/usr/bin/perl -n
printf "Serial: %s Type: %s Code: %s\n", map { tr/a-zA-Z0-9+-/ -_/; $_ = unpack
'u', chr(32 + length()*3/4) . $_; s/\0+$//; $_ ^= "C" x length; } /\.([^.]+)/g; 

Reply to: