Dear Bob

Can you please mount this on the Met Society Auckland user group. Ken Ring has been sending the badtrans virus to all climate people in NIWA. The point is that he has been sending these repeatedly, even after NIWA sent returned notification trhat his messages were virused!

Thanks

See below

Jim

------- Forwarded message follows -------
From: "Anthony Cole" <a.cole@...>
Organization: NIWA (Taihoro Nukurangi)
To: j.salinger@...
Date sent: Wed, 28 Nov 2001 09:33:51 +1300
Subject: headers from Ken Ring's virus email
Priority: normal

Date sent: Sun, 25 Nov 2001 19:39:58 +1300 (NZDT)
To: security@...
From: "Procmail Security daemon" <postmaster@...>
Subject: SECURITY WARNING - possible email attack

REPORT: Trapped poisoned executable "docs.DOC.pif"
REPORT: Not a document, or already poisoned by filename. Not scanned for macros.
STATUS: Message quarantined in /var/mail/quarantine, not delivered to recipient.

Headers from message:

> From ken@... Sun Nov 25 19:39:56 2001
> Return-Path: <ken@...>
> Received: from niwa.cri.nz (clam.niwa.cri.nz [192.168.60.8])
> by storm.niwa.cri.nz (8.11.1/8.11.2) with ESMTP id fAP6duZ53127
> for <salinger@...>; Sun, 25 Nov 2001 19:39:56 +1300 (NZDT)
> Received: from mta3-rme.xtra.co.nz (mta3-rme.xtra.co.nz [210.86.15.131])
> by niwa.cri.nz (8.11.2/8.11.2) with ESMTP id fAP6dt814532
> for <j.salinger@...>; Sun, 25 Nov 2001 19:39:55 +1300 (NZDT)
> Received: from aol.com ([210.54.87.56]) by mta3-rme.xtra.co.nz with SMTP
> id <20011125063942.WWPH4439.mta3- rme.xtra.co.nz@...>
> for <j.salinger@...>; Sun, 25 Nov 2001 19:39:42 +1300
> From: "Ken Ring" <_ken@...>
> To: j.salinger@...
> Subject: Re:
> MIME-Version: 1.0
> X-Security: MIME headers sanitized on storm.niwa.cri.nz
> See http://www.impsec.org/email-tools/procmail-security.html
> for details. $Revision: 1.129 $Date: 2001-04-14 20:20:43-07
> Content-Type: multipart/related;
> type="multipart/alternative";
> boundary="====_ABC1234567890DEF_===="
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Unsent: 1
> Message-Id: <20011125063942.WWPH4439.mta3- rme.xtra.co.nz@...>
> Date: Sun, 25 Nov 2001 19:39:55 +1300
>