On Sun, 2004-05-16 at 08:47 -0500, Ron Johnson wrote:
On Sun, 2004-05-16 at 13:30 +0100, James Ascroft-Leigh wrote:On Sat, 2004-05-15 at 20:15 -0500, Ron Johnson wrote:On Sun, 2004-05-16 at 00:25 +0100, James Ascroft-Leigh wrote:All, On Fri, 2004-05-14 at 09:57 +0900, fejj ximian com wrote:If the message will not displayed automatically, follow the link to read the delivered message. Received message is available at: www.ximian.com/inbox/evolution/read.php?sessionid-8463I am using the 1.5.7 build from Debian unstable + experimental. The[snip] Did you get this email privately, or via the ML? This reminds me of the social engineering I've seen on some recent viruses.It appeared to come from the evolution mailing list but, of course, that may be forged. Another likely explanation is that some virus scanner quarantined it.That's what the social engineer wants you to think. Do a "Show Email Source" on the original mail, and I bet that the ximian.com "link" is really a phony, that runs a virus, or sends you to a different website.
I have looked at the source and I know the link points to a mime part
with the mime type audio/x-wav but the name indicates a Microsoft
Windows screen-saver (message.scr).
What worries me is that this message is:
* Not displayed as having an attachment (no paper-clip icon) in
Evolution.
* Causes Evolution to crash.
If other people have not seen it I can obfuscate the message to get it around the scanners and repost.
You obviously have not seen the message I am referring to so I have attached it. The file is obfuscated by combining the original email source as one stream and an infinite stream of "guessmeguessme" with a bit-by-bit exclusive or operation. I am not to blame if somebody manages to infect themselves. Microsoft Windows users beware - THE ATTACHMENT CONTAINS A VIRUS.
Attachment:
obfuscated-virus
Description: Binary data
Attachment:
signature.asc
Description: This is a digitally signed message part