- NANOG - lists.nanog.org

Re: One hint - how to detect invected machines _post morten_... Re: dealing with w32/bagle
by James M. Kretchmar 05 Mar '04

05 Mar '04

Also take a look at Neo at http://www.ktools.org/ which is scriptable and does all the SNMP work behind the scenes for you. A beta of the new 2.0 version (in Python) will be out within a week. kretch > Solution: > - get all port statistics from switch (using SNMPGET and using simple > 'telnetting' script - we have 'RUN-cmd' tool allowing to run switch commands > from shell file; > - remove all ports with traffic less than some threshold; > - calculate IN/OUT packets ratio for the rest of ports; > - find ports, where IN/OUT ratio (IN - to switch) > 6; > - in this ports, find ports with average packet size < 256 bytes; > > It shows all ports with infected notebooks (even if notebook was connected > for a half of day). > > PS. Of course, after this few additional monitoring tools was installed, and > we added _all_ switches and _all_ ports to 'snmpstat' monitoring system (it > allows to see a traffic in real time, and analiz historical charts, > including such things as packet size).

1 0

Email security poll
by Jon R. Kibler 05 Mar '04

05 Mar '04

Hello all, We are conducting an informal poll regarding email security practices. Reply to me offlist and I will publish the results this weekend. Identity of replies will be kept confidential and all replies deleted after tabulation. Thanks! I will publish results this weekend. If for some reason our anti-spam filter bounces you, or you want to remain anonymous, please set your sender email address to be SURVEY _AT_ ASET.COM. -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 Please respond YES (Y), NO (N), or Not Applicable (N/A): -------------------------------------------------------- Does your organization perform any screening of email attachments? Does your organization perform A-V checks on all email attachments? Does your organization perform any checks on email attachment file type? Does your organization allow users to receive executable content attachments? Does your organization allow users to receive zip file or similar compressed attachments? Does your organization allow users to receive MS Office and similar type files that may contain macro viruses? Does your organization allow users to receive embedded or attached HTML email? Does your organization allow users to receive active content attachments, such as HTML with <SCRIPT> tags? Please respond as appropriate: ------------------------------ What AV engine do you use to screen email attachments (Symantec, NAI, FProtect, Trend, ClamAV, etc)? How often does your organization update its AV signatures? ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

1 0

dealing with w32/bagle
by Dan Hollis 05 Mar '04

05 Mar '04

I am curious how network operators are dealing with the latest w32/bagle variants which seem particularly evil. Also, does anyone have tools for regexp and purging these mails from unix mailbox (not maildir) mailspool files? Eg purging these mails after the fact if they were delivered to user's mailboxes before your virus scanner got a database update. -Dan

19 22

Bangalore Connectivity to USA
by Brennan_Murphy＠NAI.com 05 Mar '04

05 Mar '04

I'm investigating connectivity options between Bangalore and the US. Hoping to talk with others who have gone through the same process. What can be done to cut costs on E3+ capacity circuits? Any recommendations such as fiber plays, wireless last mile, satellite, etc. I prefer to hear from actual customers rather than sales persons. I guess basically, I'm looking for a clue on how to cut costs.

1 0

Re: dealing with w32/bagle
by JC Dill 05 Mar '04

05 Mar '04

At 07:39 PM 3/4/2004, Curtis Maurand wrote: >Too many steps. Once it's installed and configured, this one is drag and drop: <http://www.hilgraeve.com/dropchute/> They also have a solution for dynamic addressing: <http://www.hilgraeve.com/KB/KnowledgeBase/index_html?topic=DropChute&articl…> >DropChute can work with and connect to dynamic IP addresses through the >use of the address server. ldap.dropchute.com. With the address server >available to you, you can wait for calls on the Internet using a dynamic >IP address assigned by your Internet service provider. Your DropChute will >post the address on the address server so others can connect to you. jc -- p.s. Please do not cc me on replies to the list. Please reply to the list only, or to me only (as you prefer) but not to both.

2 1

The Cidr Report
by cidr-report＠potaroo.net 05 Mar '04

05 Mar '04

This report has been generated at Fri Mar 5 21:48:09 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 27-02-04 132022 92109 28-02-04 132095 92116 29-02-04 132186 92115 01-03-04 132204 92062 02-03-04 132222 91984 03-03-04 132040 92020 04-03-04 132129 92142 05-03-04 132261 92225 AS Summary 16688 Number of ASes in routing system 6718 Number of ASes announcing only one prefix 1385 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 73583360 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 05Mar04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 132415 92202 40213 30.4% All ASes AS4323 694 205 489 70.5% TWC-34 Time Warner Communications, Inc. AS7018 1385 963 422 30.5% ATTW AT&T WorldNet Services AS6197 676 302 374 55.3% BNS-14 BellSouth Network Solutions, Inc AS701 1319 946 373 28.3% UU UUNET Technologies, Inc. AS7843 491 120 371 75.6% ADELPH-13 Adelphia Corp. AS27364 388 33 355 91.5% ARMC Armstrong Cable Services AS6198 545 215 330 60.6% BNS-14 BellSouth Network Solutions, Inc AS4134 646 326 320 49.5% CHINANET-BACKBONE No.31,Jin-rong Street AS22909 354 34 320 90.4% CMCS Comcast Cable Communications, Inc. AS22773 349 37 312 89.4% CXAB Cox Communications Inc. Atlanta AS1239 939 655 284 30.2% SPRN Sprint AS4355 385 101 284 73.8% ERSD EARTHLINK, INC AS6347 367 87 280 76.3% SAVV SAVVIS Communications Corporation AS9583 387 118 269 69.5% SATYAMNET-AS Satyam Infoway Ltd., AS6140 373 110 263 70.5% IMPSA ImpSat AS17676 295 42 253 85.8% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS1221 888 644 244 27.5% ASN-TELSTRA Telstra Pty Ltd AS6478 267 40 227 85.0% ATTW AT&T WorldNet Services AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS209 720 507 213 29.6% QWEST-4 Qwest AS14654 214 4 210 98.1% WAYPOR-3 Wayport AS11305 242 41 201 83.1% INTERL-80 Interland Incorporated AS2386 431 240 191 44.3% ADCS-1 AT&T Data Communications Services AS4766 436 245 191 43.8% KIX Korea Internet Exchange for "96 World Internet Exposition AS5668 349 161 188 53.9% CIH-12 CenturyTel Internet Holdings, Inc. AS20115 605 419 186 30.7% CHARTE-72 Charter Communications AS4519 204 21 183 89.7% MAASCO Maas Communications AS9929 209 30 179 85.6% CNCNET-CN China Netcom Corp. AS6327 206 28 178 86.4% SHAWC-2 Shaw Communications Inc. AS3356 849 681 168 19.8% LEVEL3 Level 3 Communications Total 15456 7371 8085 52.3% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 64.46.0.0/18 AS7850 IHIGHW iHighway.net, Inc. 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.60.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.62.126.0/23 AS25700 SWIFTD SWIFTDESK VENTURE 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 66.114.28.0/24 AS15083 INMM Infolink Communication Services, Inc. 66.114.29.0/24 AS15083 INMM Infolink Communication Services, Inc. 66.114.30.0/24 AS15083 INMM Infolink Communication Services, Inc. 66.114.31.0/24 AS15083 INMM Infolink Communication Services, Inc. 69.8.128.0/17 AS7260 NORL Norlight Telecommunications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 164.234.0.0/16 AS721 DNIC DoD Network Information Center 164.234.0.0/18 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 DISOUN DISO-UNRRA 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS568 DISOUN DISO-UNRRA 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.192.0/20 AS568 DISOUN DISO-UNRRA 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.2.64.0/20 AS9729 IS-AP iAdvantage Limited 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.24.0/24 AS17888 SINGTEL-HK SingTel Hong Kong Limited 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.128.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.86.171.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.172.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.190.0/24 AS4750 LOXLEY-TH Loxley Information Co., Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.143.56.0/21 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.149.240.0/21 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.149.248.0/21 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.155.243.0/24 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.170.128.0/22 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.170.133.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.170.134.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.87.224.0/19 AS4799 CHINA169-JT CNCGROUP old Jitong IP network 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.108.34.0/24 AS852 AGTA Telus Advanced Communications 206.108.35.0/24 AS852 AGTA Telus Advanced Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.205.95.0/24 AS6347 SAVV SAVVIS Communications Corporation 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.240.96.0/19 AS10815 KCNETI-1 KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 209.251.64.0/19 AS10266 MDCN MDC, Inc. 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 222.192.0.0/14 AS4538 ERX-CERNET-BKB China Education and Research Network Center Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Warning - new trend of attempts to infect ISP users (possibly virus)
by william(at)elan.net 05 Mar '04

05 Mar '04

I have just seen emails (several different kinds) pretending to be sent from 3 of my isp domains to users of those domains warning users that their email account would be disabled and asking to open a .pif attachment. I know largest ISPs probably have expierenced this but I believe what I have seen today means they are after ISPs (or possibly just after any domains with number of email addresses under them) of all sizes right at the moment. All emails we received from the same source ip - 129.59.206.187 Please check your email base for what looks like the following (in the examples I changed everything to elan.net, actually every isp domain received different example of this, only first one is exact). Example 1: --- From: management(a)elan.net To: xxxxx(a)elan.net Subject: Email account utilization warning. Hello user of Elan.net e-mail server, Your e-mail account has been temporary disabled because of unauthorized access. For further details see the attach. Best wishes, The Elan.net team http://www.elan.net --- Example 2: --- From: administration(a)elan.net To: xxxx(a)elan.net Subject: Warning about your e-mail account. Dear user of "Elan.net" mailing system, Our main mailing server will be temporary unavaible for next two days, to continue receiving mail in these days you have to configure our free auto-forwarding service. Further details can be obtained from attached file. Cheers, The Elan.net team http://www.elan.net --- Example3: --- To: xxxxx(a)elan.net Subject: Warning about your e-mail account. From: administration(a)elan.net Dear user, the management of Elan.net mailing system wants to let you know that, Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions. Please, read the attach for further details. The Management, The Elan.net team http://www.elan.net

7 9

Re: dealing with w32/bagle
by Dr. Jeffrey Race 05 Mar '04

05 Mar '04

On Thu, 4 Mar 2004 10:17:47 -0800, Stephen Milton wrote: > >dropload.com seems to me to be the perfect model for anonymous file >delivery over the internet. I have also bookmarked, but have never used: http://www.sharemation.com/xythoswfs/webui?action=login&subaction=newuser http://www.kturn.com/ http://www.swapdrive.com/ Anyone who has used please report results back Jeffrey Race

1 0

RE: Bagle, not that smart
by Alon Tirosh 04 Mar '04

04 Mar '04

Bagle seems to simply grab everything up to and not including the second '.' Right-to-Left. I doubt they took subdomains into consideration... Im sure that now that you mentioned it here, this will be fixed in the next revision (I wonder if they file bugs with themselves?) -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Rubens Kuhl Jr. Sent: Thursday, March 04, 2004 4:05 PM To: nanog(a)merit.edu Subject: Bagle, not that smart This is a bagle sample I've received; it seems they have somewhat to learn about ccTLDs (there is no org.br domain), and to what FROM to choose (an address for university adminissions wouldn't send you a support message). Rubens ----- Original Message ----- From: admissions(a)--some-university--.edu> To: <sugestoes(a)antispam.org.br> Sent: Thursday, March 04, 2004 3:50 PM Subject: [blacklist] Notify about using the e-mail account. Dear user, the management of Org.br mailing system wants to let you know that, We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. For details see the attached file. In order to read the attach you have to use the following password: 46742. Kind regards, The Org.br team http://www.org.br [As partes desta mensagem que não continham texto foram removidas] -------------------------------------------------------------------- Enviar mensagens: mailto:pataquada@egroups.com Sair do grupo : mailto:pataquada-unsubscribe@egroups.com eGroups : http://br.egroups.com/group/pataquada/ ==================================================================== Links do Yahoo! Grupos Para visitar o site do seu grupo, acesse: http://br.groups.yahoo.com/group/pataquada/ Para sair deste grupo, envie um e-mail para: pataquada-unsubscribe(a)yahoogrupos.com.br O uso que você faz do Yahoo! Grupos está sujeito aos: http://br.yahoo.com/info/utos.html

1 0

Bagle, not that smart
by Rubens Kuhl Jr. 04 Mar '04

04 Mar '04

This is a bagle sample I've received; it seems they have somewhat to learn about ccTLDs (there is no org.br domain), and to what FROM to choose (an address for university adminissions wouldn't send you a support message). Rubens ----- Original Message ----- From: admissions(a)--some-university--.edu> To: <sugestoes(a)antispam.org.br> Sent: Thursday, March 04, 2004 3:50 PM Subject: [blacklist] Notify about using the e-mail account. Dear user, the management of Org.br mailing system wants to let you know that, We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. For details see the attached file. In order to read the attach you have to use the following password: 46742. Kind regards, The Org.br team http://www.org.br [As partes desta mensagem que não continham texto foram removidas] -------------------------------------------------------------------- Enviar mensagens: mailto:pataquada@egroups.com Sair do grupo : mailto:pataquada-unsubscribe@egroups.com eGroups : http://br.egroups.com/group/pataquada/ ==================================================================== Links do Yahoo! Grupos Para visitar o site do seu grupo, acesse: http://br.groups.yahoo.com/group/pataquada/ Para sair deste grupo, envie um e-mail para: pataquada-unsubscribe(a)yahoogrupos.com.br O uso que você faz do Yahoo! Grupos está sujeito aos: http://br.yahoo.com/info/utos.html

1 0