[no subject]

I'd say we're being *too* smart for the virus folk with this thread.  ;)

--jms

-----Original Message-----
From: ale-bounces at ale.org [<a  rel="nofollow" href="mailto:ale-bounces";>mailto:ale-bounces</a> at ale.org] On Behalf Of
Fulton Green
Sent: Wednesday, April 28, 2004 11:42 AM
To: Atlanta Linux Enthusiasts
Subject: Re: [ale] New mail trojan (this IS Linux-related)


On Wed, Apr 28, 2004 at 11:38:08AM -0400, Frank S. Glass wrote:
&gt; Quoting Fulton Green &lt;ale at FultonGreen.com&gt;:
&gt; 
&gt; &gt; I just received in my inbox a message sent from a Czech account 
&gt; &gt; masquerading as an official EarthLink message with a suspicous 
&gt; &gt; payload. Unlike most other mail trojans, this payload is in the form

&gt; &gt; of a compiled Perl script (assuming that's what the &quot;.cpl&quot; extension

&gt; &gt; stands for).
&gt; &gt; 
&gt; 
&gt; I'll bite.  How is this Linux related?  Is there some Linux MUA that 
&gt; will run a script of this form directly or through Perl?

It's conceivable that someone could have a mailcap file configured to
have Perl interpret .cpl files (Charles Shapiro's recent comment
notwithstanding). _______________________________________________
Ale mailing list
Ale at ale.org
<a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (<a  rel="nofollow" href="http://www.grisoft.com";>http://www.grisoft.com</a>).
Version: 6.0.656 / Virus Database: 421 - Release Date: 4/9/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (<a  rel="nofollow" href="http://www.grisoft.com";>http://www.grisoft.com</a>).
Version: 6.0.656 / Virus Database: 421 - Release Date: 4/9/2004
 


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="01265" href="msg01265.html">[ale] New mail trojan (this IS Linux-related)</a></strong>
<ul><li><em>From:</em> ale at FultonGreen.com (Fulton Green)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="01260" href="msg01260.html">[ale] New mail trojan (this IS Linux-related)</a></strong>
<ul><li><em>From:</em> ale at FultonGreen.com (Fulton Green)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg01262.html">[ale] New mail trojan (this IS Linux-related)</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg01264.html">[ale] Wyse Winterm 2310SE Thin Client</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg01260.html">[ale] New mail trojan (this IS Linux-related)</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg01265.html">[ale] New mail trojan (this IS Linux-related)</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#01263"><strong>Date</strong></a></li>
<li><a href="threads.html#01263"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>