North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Worm probes

  • From: Bill Larson
  • Date: Tue Sep 18 13:27:39 2001

I protected against readme.exe specifically several weeks ago. I also
proactively filter all incoming emails for executable attachments.

[Begin sample]
Regarding your message to
x msgid=<[email protected]>

You are receiving this message due to the fact a possible email attack was
detected passing through our mail servers
from you. This was probally due to a file attachment. As many of these
attachements can run on their own we only allow harmless file types to be
sent. If you wish to send this file anyway please use a compression program.
If you have further questions please do not hesitate to give me a call at
the number below.

Bill Larson [email protected]
Network Administrator
[Phone numbers here]

REPORT: Trapped poisoned executable "readme.exe"
REPORT: Not a document, or already poisoned by filename. Not scanned for
STATUS: Message quarantined, not delivered to recipient.

Message sanitized on
See for details.
[End sample]

Hopefully the notification does some good.