Date: Sat, 27 Jul 2002 06:58:12 +0000 From: "Matthew Hanson" <[EMAIL PROTECTED]> Subject: Re: [LIB]
>From: "Pres Waterman" <[EMAIL PROTECTED]> > >You most definitely did NOT get it from a guessed SMTP since 112motors.com >does not HAVE a SMTP server That makes sense. > > It's AWFULLY suspicious that I've received infected, or potentially > > infected emails from you, Pres, and David privately or from the > list >in the past 3 days. That's about one per day. Dan was the > first to have >his address spoofed in a post with the subject, "A > special powful tool" a >week ago last Wednesday on the 17th. That > post spoofed him in the same >way as the one that spoofed David and > Pres: > > > > From: daniel <[EMAIL PROTECTED]> > > From: adorablelibretto <[EMAIL PROTECTED]> > > From: pres <[EMAIL PROTECTED]> > > > >Again. "pres@112motors" has not been used for many months. I would >appreciate it if you would add the word "apparently from" when saying they >came "from" You're right. I should have been more precise. I did go on to point out that that the virus had 'spoofed' your address, a term used to describe the process of altering the 'From:' field to make it appear the email came from someone other than the actual sender. >In fact, as I said, any time I have a return address it is only an alias. >Now, I don't challenge you to learn my actual email box name, but I am sure >it is not visible to the unaided eye. It's not, and has never been, pres or >[EMAIL PROTECTED] Still the email address, '[EMAIL PROTECTED]' is all over the archives from your posts. All it would seem to take to grab that address and spoof it would be one file on an infected Klez or Nimda system that included that email address. If that happened, the file must have contained my address too. But the deal of this old email address you used to use, along with the ones David and Neil are using presently, all being selected by 3 different viruses to spoof in a 3 day period, makes me wonder if this is really the result of virus automation. If it is, I'd love to figure out an explanation. Both the email that spoofed "pres <[EMAIL PROTECTED]>" and the email that spoofed "adorablelibretto <[EMAIL PROTECTED]>" addresses in the "From:" field of two posts with Klez variants I received, came from the same server over in Israel. The addresses of the two actual senders were different in the source code, but who really knows? Now of course the mail may only have been sent via that server, and may not necessarily have originated in Israel. Matt Still no one on the list writing to say they too received copies of the messaages I got from those spoofed addresses. _________________________________________________________________ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://www.silverace.com/libretto/ - Archives -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
