Welcome to Spamcop's help forum. When posting messages you should turn
off your HTML and only post messages in plain text.
The hahaha messages are being sent from an infected computer, and the
owner probably doesn't know it's infected. If you want to trace the
messages, you'll have to turn on your full mail headers. Either read
the help file for your mail program or go to
http://spamcop.net/fom-serve/cache/19.html
and click on your e-mail program.
When you've turned on your full headers, look at the lines in the header
that begin with Received. The one nearest the top of the header should
contain your own Internet/e-mail provider. The one nearest the bottom of
the header is the sender's Internet/e-mail provider. See if you
recognize the domain name (such as bellsouth.net or aol.com) in your
header. Is it the same as someone in your address book?
([EMAIL PROTECTED])
And if you get really ambitious, you can read all about e-mail headers
at
http://www.stopspam.org/email/headers/headers.html
You should also go to http://www.sexyfun.net and I'm not kidding. It is
not a porn site. This web site was created AFTER the worm became
widespread. It has lots of info about the Snowhite worm.
Hope this helps.
CJ
> Sheryl wrote:
>
> Hi,
> I have for some time now been receiving a email with hahaha snow white
> and seven drawfs...I know this is a virus or worm, so I had just
> blocked sender to delete file.. This has been going on now for months.
> I now would like to catch the one where the mail comes from.
> What do I need to do?
> I got this mail this morning. However new virus control caught it, and
> it was in delete folder anyway. It does come 1 a week or every so
> often, I have not tracked that information. I will create a folder for
> it today.
>
> Any clues?
> Thanks!
> Sheryl Hale
>
>
>
> In the life changing business.
> Independent Professional
> Sheryl Hale
> 785-263-3493
>
> A wise man investigates what a fool takes for granted.
> So check it out and learn how to soar.
>
> "If you can't do it, I'll definitely understand."
>
> ��������R�����������������������I�������������M�����������������P������
>
> 10 minutes -2- FORTUNE!
> www.go.to/10min2Fortune
>
> Opportunity NOW-here! All products guaranteed for 365 days!
> To access the E-Merge Presentation click :
> http://www.ygy4u.com/sheryll
>
> Long distance for 0.0139 cents a minute!
> http://www.cditelecom.com/1874001
>
> If you wish to be removed (gasp!) due to relocation in the Federal
> Witness Protection program, or another good reason, you can send a
> request at anytime by replying to is email with remove in the subject
> line.
_______________________________________________
SpamCop-Help mailing list
[EMAIL PROTECTED]
http://news.spamcop.net/mailman/listinfo/spamcop-help
