[Dshield] another note...

John Sage jsage at finchhaven.com
Mon Nov 26 18:46:46 GMT 2001

Johannes, and list:

I *really* apologize for not munging the suspect file names in that post!

It got bounced back from the snort list, and I went "Oh sh*t.." and 
realized the implications of what I'd done :-(

Not being a Window$ shop (as small as it is, here...) I tend to think 
about a lot of that email-borne worm stuff as affecting another universe.


- John

Johannes B. Ullrich wrote:

> Hash: SHA1
> Just another note: If you are posting to this list, please be a bit 
> careful about the fact that a lot of readers of this list use antivirus 
> software on their mail server. While all mail to the list is scanned (by a 
> virus scanner, and manually by Wayne or myself), sometimes people add 
> content that is picked up as a virus by some of the simpler scanners. Try 
> to 'obfuscate' such signatures...
> Sometimes, they are hard to spot however... For example this post:
> http://www1.dshield.org/pipermail/dshield/2001-November/001937.html
> lists the 'badtrans' mail headers. I am getting a ton of notifications 
> from various virus filters that detect this post as a virus :-/
> Maybe a better way in this particular case would be to add a '>' a the 
> beginning of each line of the header...
>   Anyway...
> - -- 
> - -------
> jullrich at sans.org                    Join http://www.DShield.org
>                           Distributed Intrusion Detection System
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> iD8DBQE8AnlhVOIizK5pIDMRArtAAJ4xA5KLhI0c5sEA+iRzV12lkxiJxACgtwyo
> G1hV08pDJztDPXvEftyXoaE=
> =h4a8
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see: http://www1.dshield.org/mailman/listinfo/dshield

John Sage
FinchHaven, Vashon Island, WA, USA
mailto:jsage at finchhaven.com

More information about the list mailing list