[email protected] mail, DONT OPEN
Thursday, May 22, 2003 by Styl-X Design | Discussion: WinCustomize Talk
I just got them, I got 2 mails: one about an app, and one about 'requested' info.
It says: all you requested info is in the atatchment. These mails are viruses, so don't open them.
I got them in my outlook, (I have an account by hccnet ) not active on hotmail as far as I know....
just letting you know
It says: all you requested info is in the atatchment. These mails are viruses, so don't open them.
I got them in my outlook, (I have an account by hccnet ) not active on hotmail as far as I know....
just letting you know
 |
|
Page 1 of 2 | |
|
|---|
yrag2
Reply #3 Thursday, May 22, 2003 9:48 AM
Reply #3 Thursday, May 22, 2003 9:48 AM
http://www.microsoft-watch.com/ is as close as I can get to the story on this . Item is at bottom
of page
[Message Edited]
[Message Edited]
KarmaGirl
Reply #4 Thursday, May 22, 2003 10:10 AM
Reply #4 Thursday, May 22, 2003 10:10 AM
Got about 500 of those at stardock support.
All viruses. The IP address that it comes from changes and it's not from Microsoft (the virus is spoofing the sender info).
Styl-X Design
Reply #5 Thursday, May 22, 2003 10:14 AM
Reply #5 Thursday, May 22, 2003 10:14 AM
Hahaha, what happends if you send them back? das microsoft gets them?
yrag2
Reply #6 Thursday, May 22, 2003 10:15 AM
Reply #6 Thursday, May 22, 2003 10:15 AM
lets try this again.. nope..will have to work on my link finger.....Grrrrr
[Message Edited]
[Message Edited]
citats
Reply #8 Thursday, May 22, 2003 10:20 AM
Reply #8 Thursday, May 22, 2003 10:20 AM
well the bounce back should return it to the mail server that sent it to your isp's server and in turn that server should return it to the location it recieved it from. However if the viri writer was able to spoof the header and prevent the mail servers from adding their info somehow... who knows where it would end up on a bounce back...
Styl-X Design
Reply #9 Thursday, May 22, 2003 10:20 AM
Reply #9 Thursday, May 22, 2003 10:20 AM
The subject lines include:
Your Password
Screensaver
Re: Movie
Your details
Approved (Ref: 38446-263)
Re: Approved (Ref: 3394-65467)
Cool screensaver
Re: My details
Re: My application
Re: Movie
The message body reads, "All information is in attached file."
Your Password
Screensaver
Re: Movie
Your details
Approved (Ref: 38446-263)
Re: Approved (Ref: 3394-65467)
Cool screensaver
Re: My details
Re: My application
Re: Movie
The message body reads, "All information is in attached file."
yrag2
Reply #10 Thursday, May 22, 2003 10:24 AM
Reply #10 Thursday, May 22, 2003 10:24 AM
http://security.ziffdavis.com/?kc=SCZD10303TTX1B0000566
Urlryn
Reply #11 Friday, May 23, 2003 11:20 PM
Reply #11 Friday, May 23, 2003 11:20 PM
Hehe i was on tech support with Microsoft a while back when i got those emails. They demanded me to forward them and was more worried about that then my exchange 2000 issue hehehe. Bastages!
Not sure this is from the same source but i tend to get this with in mins of the microsoft support virus emails.
From [email protected] Sun Jun 13 04:44:52 1999
X-Apparently-To: via 66.218.78.207; 19 May 2003 04:36:31 -0700 (PDT)
X-YahooFilteredBulk: 217.164.79.23
Return-Path:
Received: from 217.164.79.23 (EHLO ANUP) (217.164.79.23) by mta123.mail.sc5.yahoo.com with SMTP; 19 May 2003 04:36:23 -0700 (PDT)
From: [email protected]
To:
Subject: Re: Sample
Date: Sun, 13 Jun 1999 15:44:52 +0400
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="CSmtpMsgPart123X456_000_0042AF12"
Content-Length: 64394
So don't open these either
Not sure this is from the same source but i tend to get this with in mins of the microsoft support virus emails.
From [email protected] Sun Jun 13 04:44:52 1999
X-Apparently-To: via 66.218.78.207; 19 May 2003 04:36:31 -0700 (PDT)
X-YahooFilteredBulk: 217.164.79.23
Return-Path:
Received: from 217.164.79.23 (EHLO ANUP) (217.164.79.23) by mta123.mail.sc5.yahoo.com with SMTP; 19 May 2003 04:36:23 -0700 (PDT)
From: [email protected]
To:
Subject: Re: Sample
Date: Sun, 13 Jun 1999 15:44:52 +0400
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="CSmtpMsgPart123X456_000_0042AF12"
Content-Length: 64394
So don't open these either
Lady_Akasha
Reply #12 Friday, May 23, 2003 11:29 PM
Reply #12 Friday, May 23, 2003 11:29 PM
I just got it tonight. 
I knew something was fishy when it said 're:movie'
I immediately though yeah, Microsoft is emailing me regarding a movie. Alrighty then.
Norton's scanned it and noticed the virus. Are you ready for it's title? Nortons report can be unclean file, blah blah but showed the title inside of it being "SoBIG@BOOM!"
I knew something was fishy when it said 're:movie'
I immediately though yeah, Microsoft is emailing me regarding a movie. Alrighty then.
Norton's scanned it and noticed the virus. Are you ready for it's title? Nortons report can be unclean file, blah blah but showed the title inside of it being "SoBIG@BOOM!"
Vtach
Reply #13 Friday, May 23, 2003 11:50 PM
Reply #13 Friday, May 23, 2003 11:50 PM
Hi all,
I just got it too, my application.
My e-mail had a message telling me they (optonline) caught it and deleted it. So i did a scan with norton and it said no viruses. Anything else i should do to make sure my PC is CLEAN???
Thanks
I just got it too, my application.
My e-mail had a message telling me they (optonline) caught it and deleted it. So i did a scan with norton and it said no viruses. Anything else i should do to make sure my PC is CLEAN???
Thanks
Fuzzy Logic
Reply #14 Saturday, May 24, 2003 2:48 AM
Reply #14 Saturday, May 24, 2003 2:48 AM
I used Mailwasher to delete the e-mail while it was still on the server. Between that, my ISP's scanning service and Nortons, I'm 'reasonably' safe. There's no such thing as 100% safe, but you can get close.
Edited typo...
[Message Edited]
[Message Edited]
Jafo
Reply #16 Saturday, May 24, 2003 5:37 AM
Reply #16 Saturday, May 24, 2003 5:37 AM
Styl....not any more...but you have one too many 'p's in tripple....
EventHorizon
Reply #17 Saturday, May 24, 2003 6:15 AM
Reply #17 Saturday, May 24, 2003 6:15 AM
'Tripple', yea I thought it looked funny. 
I have yet to get the infamous email...Anyone have any idea on what the virus'es payload is?
I have yet to get the infamous email...Anyone have any idea on what the virus'es payload is?
Ingui
Reply #18 Saturday, May 24, 2003 8:08 AM
Reply #18 Saturday, May 24, 2003 8:08 AM
Like Vtach, Im on Optonline and they caught the virus. The message I received was:
An e-mail delivered to you contained a virus. The virus was
identified by the Optimum Online E-mail Virus Protection system
using Symantec's Norton Anti Virus Technology. Please contact
and advise the sender of the virus-specific information provided below.
your_details.pif was infected with the malicious virus W32.HLLW.Mankx@mm
and has been deleted because the file cannot be cleaned.
I followed the header info to RIPE who only issued the Domain and their "whois" gave an addy in the Czech Republic
inetnum: 213.180.32.0 - 213.180.47.255
netname: CLNET
descr: CL-NET s.r.o.
descr: Ceska Lipa
country: CZ
admin-c: OP23-RIPE
tech-c: CLOP1-RIPE
status: ASSIGNED PA
notify: [email protected]
mnt-by: CLNET-MNT
changed: [email protected] 20010824
changed: [email protected] 20020226
source: RIPE
route: 213.180.32.0/19
descr: CLNET
descr: CZ
origin: AS16246
mnt-by: CLNET-MNT
changed: [email protected] 20010720
source: RIPE
role: CLNet Operations Team
address: Jindricha z Lipe 91
address: Ceska Lipa
address: 47001
address: Czech Republic
phone: +420 487 824333
phone: +420 724 397444
fax-no: +420 487 832923
e-mail: [email protected]
admin-c: OP23-RIPE
tech-c: OP23-RIPE
nic-hdl: CLOP1-RIPE
mnt-by: CLNET-MNT
changed: [email protected] 20021108
source: RIPE
person: Ondrej Pejsa
address: CL-Net, Ltd.
address: Jindricha z Lipe 124
address: Ceska Lipa
address: 470 01
address: Czech Republic
phone: +420 425 824333
fax-no: +420 425 823452
e-mail: [email protected]
nic-hdl: OP23-RIPE
changed: [email protected] 19980402
source: RIPE
Maybe we could send a mail bomb there
An e-mail delivered to you contained a virus. The virus was
identified by the Optimum Online E-mail Virus Protection system
using Symantec's Norton Anti Virus Technology. Please contact
and advise the sender of the virus-specific information provided below.
your_details.pif was infected with the malicious virus W32.HLLW.Mankx@mm
and has been deleted because the file cannot be cleaned.
I followed the header info to RIPE who only issued the Domain and their "whois" gave an addy in the Czech Republic
inetnum: 213.180.32.0 - 213.180.47.255
netname: CLNET
descr: CL-NET s.r.o.
descr: Ceska Lipa
country: CZ
admin-c: OP23-RIPE
tech-c: CLOP1-RIPE
status: ASSIGNED PA
notify: [email protected]
mnt-by: CLNET-MNT
changed: [email protected] 20010824
changed: [email protected] 20020226
source: RIPE
route: 213.180.32.0/19
descr: CLNET
descr: CZ
origin: AS16246
mnt-by: CLNET-MNT
changed: [email protected] 20010720
source: RIPE
role: CLNet Operations Team
address: Jindricha z Lipe 91
address: Ceska Lipa
address: 47001
address: Czech Republic
phone: +420 487 824333
phone: +420 724 397444
fax-no: +420 487 832923
e-mail: [email protected]
admin-c: OP23-RIPE
tech-c: OP23-RIPE
nic-hdl: CLOP1-RIPE
mnt-by: CLNET-MNT
changed: [email protected] 20021108
source: RIPE
person: Ondrej Pejsa
address: CL-Net, Ltd.
address: Jindricha z Lipe 124
address: Ceska Lipa
address: 470 01
address: Czech Republic
phone: +420 425 824333
fax-no: +420 425 823452
e-mail: [email protected]
nic-hdl: OP23-RIPE
changed: [email protected] 19980402
source: RIPE
Maybe we could send a mail bomb there
Styl-X Design
Reply #19 Saturday, May 24, 2003 11:24 AM
Reply #19 Saturday, May 24, 2003 11:24 AM
Jafo, you might want to considder to charge 1 dollar for evry spelling mistake you find on the forum, you would become rich
kona0197
Reply #20 Saturday, May 24, 2003 1:38 PM
Reply #20 Saturday, May 24, 2003 1:38 PM
I've told jafo that a million times it seems. Who needs a spellchecker? We have good ol' Jafo
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 1 of 2 | |
|
|---|
Reply #1 Thursday, May 22, 2003 9:44 AM