[Avcheck] Funny messed up

Robbert Kouprie kouprie@fox-it.com
Wed, 26 Sep 2001 16:04:58 +0200


This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_000_01C14694.3E32C961
Content-Type: text/plain;
	charset="iso-8859-1"

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ehm... the virus itself?

Regards,
- - Robbert

Robbert Kouprie                           t  015 - 21 21 907
Fox-IT Forensic IT Experts                f  015 - 21 21 964
Oude Delft 47                             e  kouprie@fox-it.com
2611 BC  Delft                            i  www.fox-it.com



- -----Oorspronkelijk bericht-----
Van: Juri Haberland [mailto:haberland@altus.de]
Verzonden: woensdag 26 september 2001 15:59
Aan: Michael Tokarev
CC: 'AVCheck Mailing List (E-mail)'
Onderwerp: Re: [Avcheck] Funny messed up


Michael Tokarev wrote:
> 
> Johan de Vries wrote:
> >

> > This is none critical but when i receive a mail report of a virus
> > and the virus is a Magistr A, then the  sender field is not
> > correct
> [snip -- changed from addresses]
> 
> Yes, I know about this problem from amavis mailinglist.
> In fact, there is little we can do here.  But I have an
> idea at least.

Hmm, I'm relatively new to avcheck, but who introduces the change?
AVP,
avcheck, postfix (I highly doubt the last one;)?

Juri

- -- 
  If each of us have one object, and we exchange them,
     then each of us still has one object.
  If each of us have one idea,   and we exchange them,
     then each of us now has two ideas.

_______________________________________________
Avcheck mailing list
Avcheck@list.innominate.org
http://innominate.org/mailman/listinfo/avcheck


-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQCVAwUBO7HgiOffVEfpFCsBAQLWFAP+IhOSZcf0A2WLYQ7Te4QlhXy52K7JRKWg
JP/faYsp+gJwEsU/AU0W2sd1mSpENXAdAQ6RO+F/1gcanuUtYqTYzHqNtGZt5xyV
NKfjRmmT5BnbCZ2KtZFy4M9R9k5FGYBgsEpnka0iIA02KW68eCiVkZ1XRxKHXa6M
TdmHVhes+zg=
=b47m
-----END PGP SIGNATURE-----

------_=_NextPart_000_01C14694.3E32C961
Content-Type: application/ms-tnef
Content-Transfer-Encoding: base64

eJ8+IgcOAQaQCAAEAAAAAAABAAEAAQeQBgAIAAAA5AQAAAAAAADoAAEIgAcAGAAAAElQTS5NaWNy
b3NvZnQgTWFpbC5Ob3RlADEIAQWAAwAOAAAA0QcJABoAEAAEADoAAwBMAQEggAMADgAAANEHCQAa
ABAABQAFAAMAGAEBCYABACEAAABCNERFRjBBNDhDNUVGNTQ1OEY2MTdBOUUxN0U1MjBCQwBnBwEE
gAEAHgAAAFJFOiBbQXZjaGVja10gRnVubnkgbWVzc2VkIHVwADQKAQ2ABAACAAAAAgACAAEDkAYA
yAoAADAAAAADADYAAAAAAAMAB4AIIAYAAAAAAMAAAAAAAABGAAAAAFKFAAB9bgEAHgAJgAggBgAA
AAAAwAAAAAAAAEYAAAAAVIUAAAEAAAAEAAAAOS4wAAsAEYAIIAYAAAAAAMAAAAAAAABGAAAAAAaF
AAAAAAAAAwASgAggBgAAAAAAwAAAAAAAAEYAAAAAAYUAAAAAAAALAACACCAGAAAAAADAAAAAAAAA
RgAAAAADhQAAAAAAAAsAG4AIIAYAAAAAAMAAAAAAAABGAAAAAA6FAAAAAAAAAwACgAggBgAAAAAA
wAAAAAAAAEYAAAAAEIUAAAAAAAADAByACCAGAAAAAADAAAAAAAAARgAAAAARhQAAAAAAAAMAHoAI
IAYAAAAAAMAAAAAAAABGAAAAABiFAAAAAAAAHgBwAAEAAAAaAAAAW0F2Y2hlY2tdIEZ1bm55IG1l
c3NlZCB1cAAAAAIBcQABAAAAGwAAAAHBRpNTilrVQAXzYkcupOKIMjoq5sYAACu/4AADACYAAAAA
AAMALgAAAAAACwACAAEAAAADAAlZAQAAAB4AQhABAAAAHQAAADwzQkIxREYwQS4zQzAxQzBBMUBh
bHR1cy5kZT4AAAAAAwDeP69vAAACAQkQAQAAAHYFAAByBQAA4wgAAExaRnUK0/YThwAKAQ0DQ3Rl
eHQB9/8CpAPkBesCgwBQAvMGtAKDJjIDxQIAY2gKwHNl2HQwIAcTAoB9CoAIz78J2QKACoQLNxLC
AdAgCuMKIAqALRhSQkVHSSBOIFBHUAYASUcITkVEBdBFU1NBDEdFGFMX5Uhhc2hyOgYASEEAUBf0
F+VFCGhtLhyQIHRoZSAgdmlydQQgaXQRE6BsZj8bjFJlZ2kLEXMsF+YgH7AIAGKaYgSQdB3tIAQg
SwhgPnAIgRfAIk8i1gVAIDAkMTUfwTIxJGI5MAI3F+VGb3gtSVROICVwFUAAgWMgJbFFXHhwIDEE
ICLdZiP9NpI0F+VPdQEAIEQdobkFQDQ3It8rOiIhayHUrkACECWQHXAuBaBtF+XIMjYxJIBCQxfA
KfSrLu8vmGkXwHcw0C4s/9cxvx91GFJPBbBzIfACIMJrHaBpamsgICEmQLRodBoqVgBwGyBKCHEO
IBrgICELYG5kIFtjAMADEHRvOhNwNsVA1QdAdB1ALgEAXTWWBJBOegIgAQA2IXdvJhFkZGFnJGA2
IBOgBTBlVwbQBJAkYDAkECAkIDpUNTkX5UE2Ek01AWEhHaAgVG9rCsBldgkX5UNDGyAnQVZDdRzg
YzSwTTdhC4A6gEybBAAFQCgaEDdSKScpNuk5sXJ3BJBwGyAewBsgWFtBdhNgPsFdJdB18G5ueSAH
gROgNyAh4L8yLxgSPN0wwANgDvA6F+XmPhfWRnBKbxNwA6Apwe5WCIEEIEWtPhuMSOE9QO5oBAAd
YAQgbgIgHPAFAa50JkAHQDTAdQVAdxzghwOgMKAVQGNlaXYc8C5hQrA3YUwxcBThIG//KBBMwB0T
SYk3AhzZBCBMwM0/AGc/kQXAQSwcwgOg3xzSOsFA4igACJBsNyBKg58gVknyBaFMQVKYW3MDAO5w
M4FK8EdBZ0MBA1JMsGxkZBVAQuFzOOZGeVn7B5BQsEksYEqwB+ABoAhg/wVAHNBKUTQhAmA7EFVV
AMC/HRAEIDdSP0E0gD+gLlZX6kkDoGYA0HRQsxVASnI/NIACQFkgMMBK4UdSbyD/XBIcsC5AS6FX
wBNwTJILkO1WZmkBAEzAYQVAWSAa8NNaxxp2bW1XoSdVkBVA9wtgSzBMkGxCoErQB+A3kP9MsEHk
ULBLlF2AC4BQcARwfnVMYAQgHNJU5B3WPoBQ3x82YudNUD+gUeB4P8BeUZhpZ2hiQV1wdWJYcs8c
8AtgP6FKwTspHd02Uu8ynx+wF+UXwEkoEF+QE2DfTZIdQV5zSsIgAGpTkVCw/zcCXQEPAFTkHMJh
UGvHI7L/S+JsiT+gAxADIBNwBCBtiP9a1mw/bUZfclCwF8BuT29f93BtV/JxsnQ6EF9jOKAbjP5f
ej97T3waPBZB5FoWXIG7P6B9LEBakwuASrBtC4C3X8Bd0AWwZxflNSB0QVC0Ly+AHC83UgOBL1qS
ewuAAhAvYuVDXxgfGSRB+FRVUhobOWEAkAIgGyAJGQI3Lht9aVFDVoBBd1VCTzdIUEACTwEgVkVm
cEZDAHNCQVFMV0ZBAFArSWhPU1pjAQEwQTJXTFlRNwBUZTRRbGhYeQA1Mks3SlJLV1GA5kpQL1ug
WTQQKwBnSndFc1UvQRBVMFcyOlAxbVNAcEVOWEFkizA2gFJPK0YvMWddMQB1VXRZcVRZegBIcU50
R1p0NQh4eVaFJU5LZmoCUmFAVDVCbmJDAlqNMHRaRnk0TQA5UjlrNUZHWSBCZ3NFcDRQYTAQaUlB
MI0wVzY4AGVDaVZrWjFYAFJ4S0hYYTZNQYUlVGRtSFYc4HOQK3pnPYUlPWIqUL8thoWTj9AZkIZP
GmZ9myAAAAMA/T/kBAAAQAA5APDc3TmURsEBAwDxPxMEAAAeADFAAQAAAAkAAABST0JCRVJUSwAA
AAADABpAAAAAAB4AMEABAAAACQAAAFJPQkJFUlRLAAAAAAMAGUAAAAAAAwCAEP////8LAPIQAQAA
AAIBRwABAAAAOwAAAGM9VVM7YT0gO3A9Rm94LUlUIEZvcmVuc2ljIDtsPUZPWFNFUlZFUi0wMTA5
MjYxNDA0NThaLTIyNzIAAAIB+T8BAAAAXwAAAAAAAADcp0DIwEIQGrS5CAArL+GCAQAAAAAAAAAv
Tz1GT1gtSVQgRk9SRU5TSUMgSVQgRVhQRVJUUy9PVT1GT1gyMDAwL0NOPVJFQ0lQSUVOVFMvQ049
Uk9CQkVSVEsAAB4A+D8BAAAAEAAAAFJvYmJlcnQgS291cHJpZQAeADhAAQAAAAkAAABST0JCRVJU
SwAAAAACAfs/AQAAAF8AAAAAAAAA3KdAyMBCEBq0uQgAKy/hggEAAAAAAAAAL089Rk9YLUlUIEZP
UkVOU0lDIElUIEVYUEVSVFMvT1U9Rk9YMjAwMC9DTj1SRUNJUElFTlRTL0NOPVJPQkJFUlRLAAAe
APo/AQAAABAAAABSb2JiZXJ0IEtvdXByaWUAHgA5QAEAAAAJAAAAUk9CQkVSVEsAAAAAQAAHMFTH
jQKURsEBQAAIMGHJMj6URsEBHgA9AAEAAAAFAAAAUkU6IAAAAAAeAB0OAQAAABoAAABbQXZjaGVj
a10gRnVubnkgbWVzc2VkIHVwAAAAHgA1EAEAAAAzAAAAPEQ1OEQzRTE5NjFDNTgwNDNCRDgyODA2
NUQxMkU0OTk1MERBNUJBQGZveHNlcnZlcj4AAAsAKQAAAAAACwAjAAAAAAADAAYQiWK1hgMABxDl
BAAAAwAQEAAAAAADABEQAAAAAB4ACBABAAAAZQAAAC0tLS0tQkVHSU5QR1BTSUdORURNRVNTQUdF
LS0tLS1IQVNIOlNIQTFFSE1USEVWSVJVU0lUU0VMRj9SRUdBUkRTLC0tUk9CQkVSVFJPQkJFUlRL
T1VQUklFVDAxNS0yMTIxOTAAAAAAAgF/AAEAAAAzAAAAPEQ1OEQzRTE5NjFDNTgwNDNCRDgyODA2
NUQxMkU0OTk1MERBNUJBQGZveHNlcnZlcj4AAC/J

------_=_NextPart_000_01C14694.3E32C961--