[TriLUG] [Fwd: MailScanner: Clam and SA3 installer]

[Jeremy Portzer]

It's just a forwarded message, Content-Type: message/rfc822 .  That's
not dangerous at all.  I tried using evolution, pine, and 'mail' to read
the e-mail and in neither circumstance did I see anything with ".eml" in
the attachment -- perhaps that was generated by your local reader? 
Filename extensions shoudln't matter anyway, it's MIME types that make
the difference.

Sending forwarded emails using MIME type message/rfc822 is extremely
common and is not something I would be suspicious about by default.

Jeremy

On Mon, 2004-08-30 at 15:58, Brian Henning wrote:
> Yow.
>   This looks somewhat suspicious..  Jon?  Attaching .eml attachments?  On
> closer inspection it's just text, but after Nimda I'm automatically wary of
> anything ending in .eml...
> 
> 

-- 
/---------------------------------------------------------------------\
| Jeremy Portzer        jeremyp at pobox.com      trilug.org/~jeremy     |
| GPG Fingerprint: 712D 77C7 AB2D 2130 989F  E135 6F9F F7BC CC1A 7B92 |
\---------------------------------------------------------------------/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://www.trilug.org/pipermail/trilug/attachments/20040830/e8b01abc/attachment.pgp>