[28537] in North American Network Operators' Group
RE: uuencoded Love Worm variant
daemon@ATHENA.MIT.EDU (Roeland Meyer (E-mail))
Fri May 5 14:59:22 2000
Reply-To: <rmeyer@mhsc.com>
From: "Roeland Meyer (E-mail)" <rmeyer@mhsc.com>
To: "'Bennett Todd'" <bet@rahul.net>,
"'Eric Conrad'" <econrad@bu.edu>
Cc: <nanog@merit.edu>
Date: Fri, 5 May 2000 11:57:25 -0700
Message-ID: <004501bfb6c3$c11e2740$eaaf6cc7@PEREGRIN>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
In-Reply-To: <20000505141850.F618@rahul.net>
Errors-To: owner-nanog-outgoing@merit.edu
most modern mailers wil automagically uudecode.
> -----Original Message-----
> From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of
> Bennett Todd
> Sent: Friday, May 05, 2000 11:19 AM
> To: Eric Conrad
> Cc: nanog@merit.edu
> Subject: Re: uuencoded Love Worm variant
>=20
>=20
> 2000-05-05-13:44:16 Eric Conrad:
> > I caught one of these uuencoded 'in the wild'. It would have
> > slipped through my filters if not for the standard Subject: line.
>=20
> Does anyone know for sure that the uuencoded version isn't actually
> devenomed by the uuencoding? I.e. is there any known gateway that
> will turn the uuencoded attachment back into the known-virulent
> MIME, or any known MUA that will offer to execute the uuencoded
> script with a simple click? If the user has to go out of their way
> to expressly decode the thing into a file, then deliberately execute
> that file, that varient of the worm won't spread like wildfire; I'm
> content to let it pass.
>=20
> -Bennett
>=20
