Is anybody familiar with the following, which looks highly suspicious with blank
Return-Path and no good From: address? When I saw the blank return-path and
size of the file, I thought Snowhite, but this turned out to be something else.
My ISP changes .exe to ~exe in attachment file names so a careless recipient
won't accidentally run the file and spread a virus, but if the attachment is
legit, the recipient can rename to end in .exe.
Message follows, with virus code snipped:
Return-Path: <>
Received: from default (cpe-203-21-239-13.why.austar.net.au [203.21.239.13])
by w3.bluegrass.net (8.9.3/8.9.3) with SMTP id LAA01602
for <[EMAIL PROTECTED]>; Mon, 10 Sep 2001 11:40:12 -0400 (EDT)
Date: Mon, 10 Sep 2001 11:40:12 -0400 (EDT)
Message-Id: <[EMAIL PROTECTED]>
Subject: boys!!
From: Xena
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VE2J05QZK5UZGPQRCL"
Status:
----VE2J05QZK5UZGPQRCL
Content-Type: text/plain; charset="us-ascii"
slut lesbians black!
girls famous sodomized hardcore
----VE2J05QZK5UZGPQRCL
Content-Type: application/octet-stream; name="famous~EXE"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="famous~EXE"
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
(424 lines snipped)
