The link, "deobfuscated," is ht~tp://d2341647.u35.worldispnetwork.com/update/ with a username of www.microsoft.com. (I added the tilde in the 'http' so it wouldn't link)
Having a somewhat hairy underregion, I cranked up the AV and tried going there - here's the message I got: ================================ Website temporarily unavailable. Please contact your network provider for further information. Please accept our apology for the inconveniences. - lolik.u35.worldispnetwork.com site administrator ================================ I checked the code on the page - very plain, nothing fishy. This either means that the server is too busy dishing out the virus, or it's been taken down. Curt Turner --- Doug Traylor <[EMAIL PROTECTED]> wrote: > > if you could post the links > > All the links in the email are the same. See below. > I don't know if it is > still active, but according to the website I went to > , it is. Maybe > someone, with more hair on their lower regions than > me, might go there and > see and report back to us. > > *** Warning the following link is supposed to point > to an active virus. > Visit it at your own risk.(preferably not using IE) > *** > > http://www.microsoft.com > <join with no spaces to recreate link and activate> > [EMAIL PROTECTED]/update/ > > (which translates to: > @d2341647.u35.worldispnetwork.com/update/) > > Douglas Traylor > MIS Department > Harbison-Fischer Mfg Co. > (817)297-2211 x210 > > > > > ----- Original Message ----- > > From: John Tolmachoff (Lists) > > To: [EMAIL PROTECTED] > > Sent: Monday, January 26, 2004 10:26 AM > > Subject: RE: [IMail Forum] Alert - new bogus email > from > [EMAIL PROTECTED] > > > > > > Would be great if you could post the links and > such so that we can all > > adjust our filters and rules to catch it. > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > [mailto:IMail_Forum- > > > [EMAIL PROTECTED] On Behalf Of Doug > Traylor > > > Sent: Monday, January 26, 2004 8:12 AM > > > To: [EMAIL PROTECTED] > > > Subject: [IMail Forum] Alert - new bogus email > from security- > > > [EMAIL PROTECTED] > > > > > > This one doesn't contain a virus, but rather > every link in it points to > a > > > site where the virus resides. It appears very > valid. > > > > > > I only found one site on the web that mentions > it: > > > http://www.donotreply.com/archives/000006.html > > > The same fellow posted in Google Groups about > it. > > > > > > He indicates that the virus is the vbs/suzer.c > trojan, but I have not > been > > > able to verify that or find any information > about that virus. > > > > > > Douglas Traylor > > > MIS Department > > > Harbison-Fischer Mfg Co. > > > (817)297-2211 x210 > > > > > > I have a copy of the actual email if anyone > wants it. > > > > > > The text of the email follows(notice all links > point to"#" which is > really > > > www.microsoft.com#blah.blah.blah.com/virus): > > > > ___________________________________________________________________ > > > > > > Received: from ******.hfpumps.com [*.*.*.*] by > mail.hfpumps.com > > > (SMTPD32-8.05) id AB994C20284; Sun, 25 Jan > 2004 18:13:13 -0600 > > > Received: from 24.129.196.182 by > ******.hfpumps.com (InterScan E-Mail > > > VirusWall NT); Sun, 25 Jan 2004 18:13:12 -0600 > > > Date: Sun, 25 Jan 2004 12:11:27 +0000 > > > From: Security-center > <[EMAIL PROTECTED]> > > > Subject: Security warning > > > To: Postmaster <[EMAIL PROTECTED]> > > > References: <[EMAIL PROTECTED]> > > > In-Reply-To: <[EMAIL PROTECTED]> > > > Message-ID: <[EMAIL PROTECTED]> > > > MIME-Version: 1.0 > > > Content-Type: text/html > > > Content-Transfer-Encoding: 8bit > > > X-RCPT-TO: <[EMAIL PROTECTED]> > > > Status: U > > > X-UIDL: 364859815 > > > > > > [Image "Microsoft" ignored] All Products > [links to #] | Support > > > [links > > > to #] | Search [links to #] | > microsoft.com Home [links to #] > > > > > > > > > MicroSoft News > > > Warning: > > > a new virus, [EMAIL PROTECTED], can infect your > computer. > > > > > > MicroSoft user, > > > this is the latest version of security update, > the "January 2004, > > > Cumulative Patch" > > > udate which eliminates all known security > vulnerabilities afecting MS > > > Internet Explorer, > > > MS Outlook and MS Outlook Express. Install now > to maintain the security > > > of > > > your computer > > > from these vulnerabilities. This update > includes the functionality of > all > > > previously released patches. [Image ignored] > [links to #]System > > > requirements > > > Windows 95/98/Me/2000/NT/XP > > > [Image ignored] [links to #]This Update applies > to > > > MS Internet Explorer, version 5.5 and later > > > MS Outlook, version 8.0 and later > > > MS Outlook Express, version 4.01and later > > > [Image ignored] [links to #]Recommendation > Customers should install the > > > patch at the earliest opportunity > > > [Image ignored] [links to #]How to install Click > on the "Go to Download > > > page > > > [links to #]" button . > > > [Image ignored] [links to #]How to use You don't > need to do anything > after > > > installing this item > > > > > > > > > > > > > > > Microsoft Product Support Services and Knowledge > Base can be found on > the > > > Microsoft Technical Support [links to #] > Website. > > > For security-related information about Microsoft > products, please visit > > > the Microsoft Security Advisor [links to #] web > site, or Contact Us > > > [links > > > to #]. > > > > > ------------------------------------------------------------------------- > > > The names of the actual companies and products > mentioned herein are the > > > trademarks of their respective owners. > > > > > > > > > Contact Us [links to #] | E-mail This Page > [links to #] > > > 1986 - 2004 Microsoft Corporation. All rights > reserved. Terms of Use > > > [links to #] Privacy Statement [links to #] > Accessibility [links to > #] > > > > > > > > > To Unsubscribe: > http://www.ipswitch.com/support/mailing-lists.html > > > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > > Knowledge Base/FAQ: > http://www.ipswitch.com/support/IMail/ > > > > > > > > To Unsubscribe: > http://www.ipswitch.com/support/mailing-lists.html > > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: > http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: > http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free web site building tool. Try it! http://webhosting.yahoo.com/ps/sb/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
