plugers, I received an e-mail the other day and I thought it was spam so I fired up my trusty anti-spam app: ricochet (http://www.vipul.net/ricochet/) and sent out the resulting e-mails. I got this response from the originating domain. ----- Forwarded message from Casey Blackburn <[EMAIL PROTECTED]> ----- The Snowwhite emails are not being sent by the sexyfun.net domain or slowmoe.com, who is hosting the sexyfun.net domain. These emails are sent to you by the very same virus that the attachments of the Snowwhite emails are infected with. This virus, known as Hybris.gen, will use the computers that it infectes to collect email addresses that it will then send a copy of the Snowwhite email to. This virus fakes / spoofs the From: address to make it look like it came from the sexyfun.net domain. We registered the sexyfun.net domain 3-4 months after this virus was first discovered in order to setup a web site that contains information about the Snowwhite emails / Hybris.gen virus. Here is a copy of a form letter we have been using to inform people about this email / SPAM / Virus that everyone is getting. If you have any other questions about this after you read and visit the URLs in the form letter please feel free to write me back.. Thanks.. THIS IS NOT A MAILING LIST OR A REAL USER THAT SENT THE SPAM THAT CLAIMS TO BE FROM: [EMAIL PROTECTED] ITS THE W95.Hybris.gen Virus which works like the ILOVEYOU virus of a few month ago. Please Read On The domain sexyfun.net was registered on 12/11/2000 to provide the people of the internet information about the SPAM / Virus people have been receiving that contains the email address of [EMAIL PROTECTED] . We have setup a web site ( http://www.sexyfun.net/ ) that contains information about this SPAM / Virus with helpful links to other sites. The virus (W95.Hybris.gen) sends a copy of itself to all the people in the address book of a infected computer to spread itself around the world / internet. The email that is sent contains a Spoofed / Faked From: field in the header of [EMAIL PROTECTED] If you were to look at the Received: lines in the FULL email header you will notice that this email did not come from sexyfun.net but from some other computer. This some other computer is most likly a friend that has you in their address book and is not aware that they are infected with the virus. Here is a URL to a write up of the virus that will show you that indeed this virus send out emails with spoofed / faked From: fields. http://www.f-secure.com/v-descs/hybris.shtml The person who is responsible for this SPAM / Virus spoofed the email address at the sexyfun.net domain. The owner of the sexyfun.net domain is NOT affiliated with this person, this also go for slowmoe.com which is hosting web site that contains information about the SPAM / Virus. Once again sexyfun.net and slowmoe.com are NOT affiliated to the SPAM / Virus that contains the email address of [EMAIL PROTECTED] (This is a spoofed email header). sexyfun.net and slowmoe.com ARE providing information about this SPAM / Virus in the from of a web site found at http://www.sexyfun.net/ to help people that are running into it. ----- End forwarded message ----- -- Juan Miguel Cacho [EMAIL PROTECTED] ® Philippines [EMAIL PROTECTED] ...the poor count their blessings, the affluent count their calories. _ Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph To leave: send "unsubscribe" in the body to [EMAIL PROTECTED]
