Re: OUCH!!

["Bernie Cosell" <bernie @ fantasyfarm . com>]

On 23 May 2003 at 19:34, Brian Zaleski wrote:

> With an attachement called errors.zlb

'zlb' is one of the quarantine-extensions that ZoneAlarm's MailSafe uses 
right?

> With this little bit 'o code in it (and a lot more)
> 
> tmp = Split(malware, ",")
> path = "c:\command.exe"
> Set fso = CreateObject("Scripting.FileSystemObject")
 [...etc...]

My windows scripting host script-reading skills are pretty minimal.. 
could you provide a short synopsis of what this script was trying to do?

As a side note, I've heard about this particular virus-trap several times 
[although I don't think I, personally, have received one]: an apparently 
100% legit-looking (but fake) NDR with the "message" being bounced 
included as an attachment..

What's unfortunate is that that's what I use for rejects of submissions 
to the newsgroup I moderate -- because of the limitations of the tool I 
happen to use to do the moderation, having the reject message carry the 
original submission as an attachment is really the only good choice.  It 
hadn't occurred to me until I started hearing about the NDR-borne-viruses 
that I was encouraging my submittors into potentially dangerous email 
habits...

  /bernie\

-- 
Bernie Cosell                     Fantasy Farm Fibers
mailto:bernie@fantasyfarm.com     Pearisburg, VA
    -->  Too many people, too few sheep  <--