Re: [iwar] Seminar = ILOVEYOU


From: Fred Cohen
From: fc@all.net
To: iwar@egroups.com

Fri, 5 May 2000 05:55:01 -0700 (PDT)


fc  Fri May  5 05:55:14 2000
Received: from 207.222.214.225
	by localhost with POP3 (fetchmail-5.1.0)
	for fc@localhost (single-drop); Fri, 05 May 2000 05:55:14 -0700 (PDT)
Received: by multi33.netcomi.com for fc
 (with Netcom Interactive pop3d (v1.21.1 1998/05/07) Fri May  5 12:55:06 2000)
X-From_: sentto-279987-325-fc=all.net@returns.onelist.com  Fri May  5 07:54:58 2000
Received: from mr.egroups.com (mr.egroups.com [207.138.41.139]) by multi33.netcomi.com (8.8.5/8.7.4) with SMTP id HAA31699 for ; Fri, 5 May 2000 07:54:58 -0500
X-eGroups-Return: sentto-279987-325-fc=all.net@returns.onelist.com
Received: from [10.1.10.38] by mr.egroups.com with NNFMP; 05 May 2000 12:55:04 -0000
Received: (qmail 12687 invoked from network); 5 May 2000 12:55:01 -0000
Received: from unknown (10.1.10.26) by m4.onelist.org with QMQP; 5 May 2000 12:55:01 -0000
Received: from unknown (HELO all.net) (24.1.84.100) by mta1 with SMTP; 5 May 2000 12:55:01 -0000
Received: (from fc@localhost) by all.net (8.9.3/8.7.3) id FAA30475 for iwar@egroups.com; Fri, 5 May 2000 05:55:01 -0700
Message-Id: <200005051255.FAA30475@all.net>
To: iwar@egroups.com
In-Reply-To: <3.0.6.32.20000505123652.00844840@mail.mldnet.com> from "Conrad W. Clark" at May 05, 2000 12:36:52 PM
Organization: I'm not allowed to say
X-Mailer: don't even ask
X-Mailer: ELM [version 2.5 PL1]
From: Fred Cohen 
MIME-Version: 1.0
Mailing-List: list iwar@egroups.com; contact iwar-owner@egroups.com
Delivered-To: mailing list iwar@egroups.com
Precedence: bulk
List-Unsubscribe: 
Date: Fri, 5 May 2000 05:55:01 -0700 (PDT)
Reply-To: iwar@egroups.com
Subject: Re: [iwar] Seminar = ILOVEYOU
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

This is a very easy virus to mutate because it comes in source code - no
attempt to hide it.  To make that change, you only need to modify a few
words of the code.

FC

Per the message sent by Conrad W. Clark:
> 
> Hi,
> 
> At 0700GMT 5 May a director in the Republican Hospital in Moldova caught
> the worm in an email and attachment subject "Seminar".  The email was from
> Latvia.
> 
> This is very fast moving and mutating.
> 
> Conrad


------------------
http://all.net/