Re: [IMail Forum] What is this, spam?

Bill James Tue, 20 Feb 2001 19:52:47 -0800
Nah...this is the Snow White virus and sends from someone's address book and
changes the name of the attachment everytime.

Symantec has good info on it


----- Original Message -----
From: "T. Bradley Dean" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, February 20, 2001 10:20 PM
Subject: RE: [IMail Forum] What is this, spam?


> Someone with the address [EMAIL PROTECTED] has me in their address book?!
> eww...
>
> I want to start using Declude, but I've just got so many project ahead of
> that. For now it's filters and virus software.
>
> T. Bradley Dean
> (800) 793-8171 Ext. 336
> [EMAIL PROTECTED]
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Madscientist
> Sent: Tuesday, February 20, 2001 7:06 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] What is this, spam?
>
>
> Nobody mined email addresses for this one... it's a worm...
>
> It was sent right too you from someone who has you in their address
book...
> That someone has the virus in their system.
>
> Solutions include filtering and virus scanning at the server... we
> accomplish these using our IMFilter utility for filtering and Declude for
> virus scanning (using WebShield) and spam filtering.
>
> It is also recommended that you use some kind of virus protection software
> on your workstation(s).
>
> Hope this helps,
> _M
>
> | -----Original Message-----
> | From: [EMAIL PROTECTED]
> | [mailto:[EMAIL PROTECTED]]On Behalf Of Remzon P.
> | Mascardo
> | Sent: Tuesday, February 20, 2001 9:11 PM
> | To: [EMAIL PROTECTED]
> | Subject: RE: [IMail Forum] What is this, spam?
> |
> |
> | Me too, how can we filter this kind of un-noticed mail from unknown
user.
> |
> | Thanks,
> | Remz
> |
> | -----Original Message-----
> | From: [EMAIL PROTECTED]
> | [mailto:[EMAIL PROTECTED]]On Behalf Of T. Bradley Dean
> | Sent: Wednesday, February 21, 2001 9:56 AM
> | To: [EMAIL PROTECTED]
> | Subject: RE: [IMail Forum] What is this, spam?
> |
> |
> | I too received an email from [EMAIL PROTECTED] last night. It had an
> | attachment "dwarf4u.exe". I did not open the attachment.
> |
> | What's odd was that it was sent directly to me. Could this guy be
> | harvesting
> | names from the iMail list?
> |
> | T. Bradley Dean
> | (800) 793-8171 Ext. 336
> | [EMAIL PROTECTED]
> |
> | -----Original Message-----
> | From: [EMAIL PROTECTED]
> | [mailto:[EMAIL PROTECTED]]On Behalf Of Michael Varre
> | Sent: Tuesday, February 20, 2001 8:46 PM
> | To: [EMAIL PROTECTED]
> | Subject: [IMail Forum] What is this, spam?
> |
> |
> |
> | I think someone is doing something afoul.  Yesterday right after i sent
an
> | email to all the members i recieved an email from the list server saying
> | that [EMAIL PROTECTED] tried posting a msg to the list (it was
rejected).
> | Then I had an email sent to support that looks like a virus.
> | Then later in
> | the night I saw he sent me an email from the same address with what I
also
> | believe is a virus. Both emails appeared to come from
[EMAIL PROTECTED]
> | Any help would be appreciated.
> |
> | I looked at the headers of the email he sent and they are like this:
> |
> | Received: from jamesweeks [63.20.138.248] by gochatplus.com
> | (SMTPD32-6.05) id AEABED301A8; Tue, 20 Feb 2001 17:49:31 -0800
> | Subject: Snowhite and the Seven Dwarfs - The REAL story!
> | MIME-Version: 1.0
> | Content-Type: multipart/mixed;
> | boundary="--VE30HMJSLEJSPERKHMNK16BOT2JSDERSH"
> | Message-Id: <20010220174962.SM00217@jamesweeks>
> | X-RCPT-TO: <[EMAIL PROTECTED]>
> | Date: Tue, 20 Feb 2001 17:49:43 -0800
> | X-UIDL: 261612363
> | Status: U
> |
> | Notice the first line.  Then I looked in the log file for anything odd
> | connected to that username.  Here are excerpts from the log file:
> |
> | 20010220 174917 127.0.0.1       SMTPD (0B97015A) [204.168.155.100]
connect
> | 63.20.138.248 port 1072
> | 20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] HELO
> | jamesweeks
> | 20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248]
> | MAIL FROM:
> | <>
> | 20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] RCPT
TO:
> | <#$¥f@§}!P.é³Â>
> | 20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] ERR
> | gochatplus.com invalid user <#$¥f@§}!P.é³Â
> | 20010220 174919 127.0.0.1       SMTPD (0B9C015A) [204.168.155.100]
connect
> | 63.20.138.248 port 1075
> | 20010220 174919 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] HELO
> | jamesweeks
> | 20010220 174920 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248]
> | MAIL FROM:
> | <>
> | 20010220 174920 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] RCPT
TO:
> | <[EMAIL PROTECTED]>
> |
> | Then again:
> |
> | 20010220 180453 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] HELO
> | jamesweeks
> | 20010220 180453 127.0.0.1       POP3D PASS xxxxxxxx
> | 20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248]
> | MAIL FROM:
> | <>
> | 20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] RCPT
TO:
> | <ýÒå1ê-Ù@>
> | 20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] ERR
> | gochatplus.com invalid user <ýÒå1ê-Ù@>
> |
> |
> |
> | Some sort of spam attempt?
> |
> |
> | Please visit http://www.ipswitch.com/support/mailing-lists.html
> | to be removed from this list.
> |
> | An Archive of this list is available at:
> | http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> |
> |
> | Please visit http://www.ipswitch.com/support/mailing-lists.html
> | to be removed from this list.
> |
> | An Archive of this list is available at:
> | http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> |
> |
> | Please visit http://www.ipswitch.com/support/mailing-lists.html
> | to be removed from this list.
> |
> | An Archive of this list is available at:
> | http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> |
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Re: [IMail Forum] What is this, spam?

Reply via email to
