I've been getting 'snow white' virus mail for months. I got this one
recently (only header and text below. If you want this virus for some
reason, ask me). I was pretty impressed at the social engineering
involved. Note forging the voice of authority, and that earthlink is
cooperating.
Return-Path: [EMAIL PROTECTED]
Delivery-Date: Thu May 9 22:14:20 2002
Return-Path: <[EMAIL PROTECTED]>
Received: from pintail.mail.pas.earthlink.net (pintail.mail.pas.earthlink.net
[207.217.120.122])
by apocalypse.org (8.11.6/8.11.0) with ESMTP id g4A2EHT18247
for <[EMAIL PROTECTED]>; Thu, 9 May 2002 22:14:18 -0400
Received: from user-33qscsk.dialup.mindspring.com ([199.174.51.148] helo=Vsevook)
by pintail.mail.pas.earthlink.net with smtp (Exim 3.33 #2)
id 175zv4-0004WW-00
for [EMAIL PROTECTED]; Thu, 09 May 2002 19:14:07 -0700
From: MAILER-DAEMON <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Worm Klez.E immunity
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Q2mnYt922352
Message-Id: <[EMAIL PROTECTED]>
Date: Thu, 09 May 2002 19:14:07 -0700
--Q2mnYt922352
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable
<HTML><HEAD></HEAD><BODY>
<FONT>Klez.E is the most common world-wide spreading worm.It's very dangerous by
corrupting your files.<br>
Because of its very smart stealth and anti-anti-virus technic,most common AV software
can't detect or clean it.<br>
We developed this free immunity tool to defeat the malicious virus.<br>
You only need to run this tool once,and then Klez will never come into your PC.<br>
NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor
maybe cry when you run it.<br>
If so,Ignore the warning,and select 'continue'.<br>
If you have any question,please <a href=3Dmailto:[EMAIL PROTECTED]>mail to
me</a>.</FONT></BODY></HTML>
--Q2mnYt922352
Content-Type: application/octet-stream;
name=Inc..bat
Content-Transfer-Encoding: base64
Content-ID: <G1014ieOYf03544>
---
Send mail for the `bblisa' mailing list to `[EMAIL PROTECTED]'.
Mail administrative requests to `[EMAIL PROTECTED]'.
