[Dshield] another note...
jsage at finchhaven.com
Mon Nov 26 18:46:46 GMT 2001
Johannes, and list:
I *really* apologize for not munging the suspect file names in that post!
It got bounced back from the snort list, and I went "Oh sh*t.." and
realized the implications of what I'd done :-(
Not being a Window$ shop (as small as it is, here...) I tend to think
about a lot of that email-borne worm stuff as affecting another universe.
Johannes B. Ullrich wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> Just another note: If you are posting to this list, please be a bit
> careful about the fact that a lot of readers of this list use antivirus
> software on their mail server. While all mail to the list is scanned (by a
> virus scanner, and manually by Wayne or myself), sometimes people add
> content that is picked up as a virus by some of the simpler scanners. Try
> to 'obfuscate' such signatures...
> Sometimes, they are hard to spot however... For example this post:
> lists the 'badtrans' mail headers. I am getting a ton of notifications
> from various virus filters that detect this post as a virus :-/
> Maybe a better way in this particular case would be to add a '>' a the
> beginning of each line of the header...
> - --
> - -------
> jullrich at sans.org Join http://www.DShield.org
> Distributed Intrusion Detection System
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> -----END PGP SIGNATURE-----
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see: http://www1.dshield.org/mailman/listinfo/dshield
FinchHaven, Vashon Island, WA, USA
mailto:jsage at finchhaven.com
More information about the list