Date: Mon, 29 Jul 2002 08:03:17 +0000 From: "neil barnes" <[EMAIL PROTECTED]> Subject: Re: [LIB]
>Date: Fri, 26 Jul 2002 22:42:13 +0000 >From: "Matthew Hanson" <[EMAIL PROTECTED]> >Subject: Re: [LIB] > >>From: "neil barnes" <[EMAIL PROTECTED]> >> >>>From: Adrian Ho <[EMAIL PROTECTED]> >>> >>>On Fri, Jul 26, 2002 at 02:28:16AM -0700, neil barnes wrote: >>> > No, there was no attachment on them, including the one > purporting to >>>be from >>> > me - but I also got a bunch of bounced and returned to 'sender' > >>>which was >>> > forged as me and they *did* have the payload - about 90k. >>> >>>At least some members of the W32.Klez family can propagate themselves as >>>faked bounces, so that's likely what you received. >> >>According to the payload (sample.exe), it's a recent variant of the >>W32.nimda virus > >Neil, > >After reading a bit more about Nimda, Klez, their variants and >capabilities, I wonder if perhaps it's more reasonable to assume that >you’re problems are being caused by a form of one or more of these viruses, >and not by some individual misappropriating your email address. As far as I can tell, it looks like the posts allegedly from me and other list members are courtesy the nimda virus - someone on the list has it, and also has our addresses in his/her address book. The other - my easynet address, which most of you will never have seen - is not I think *targetted* at me, but more likely that my address has been harvested from my website or similar location, and used on a forged email spam advertising a 'change the size of bits of your anatomy' website. I've traced it as far as a dial-in account on a uu.net service, and the same account has been used for three separate spam attacks (I get the rude messages from the spamees, or from mail servers when the name bounces) so I've passed that to [EMAIL PROTECTED] to see what they do. So far, only an auto reply, but (fingers crossed) I haven't had a fresh burst of spam bounces in the last few days... Neil _________________________________________________________________ Join the world’s largest e-mail service with MSN Hotmail. http://www.hotmail.com ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://www.silverace.com/libretto/ - Archives -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
