Alex, I received the following email this morning from another user group I belong to. Sounds like a varient of the worm virus.
> Greetings those of you who may use Microsoft products: > > There's another round of the worm now attacking. > Beginning late last night, I've now received more than a > dozen of them, all seemingly addressed "FROM" Microsoft. > > Addresses so far: > > @advisor.msn.com > @security.microsoft.com > @advisor.microsoft.com > > Subject lins so far: > > Alert: Install at once > Emergency MS security patch > Current Internet Critical Update > > None of the emails is actually from Microsoft, and > header and IP block tracking reveals each originates > from a different source. Sources vary, and the "reply to" > and "from" fields will be different. > > Up to three attachments will be present, up to 159K: > > image/gif Content-Transfer-Encoding: base64 Content-ID: <lkulxkw> > image/gif Content-Transfer-Encoding: base64 Content-ID: <dnylilj> > application/x-msdownload; name="qdct.exe" Content-Transfer-Encoding: base64 > > Content ID and file name of the 'exe' file changes > > Message body does link to Microsoft.com > > Filter all these attachments into a trash directory and > delete them immediately. > > Do NOT open the email if you can avoid it. The GIF/JPG files > called in the hidden html tags will "ping" the sender alerting > them that the email is being accessed. > > You can avoid this by > a) opening the email while NOT connected to a network > b) running email client in TEXT only (HTML turned OFF) > > The worm producer has gained some sophistication, this post > looks very much like an official Microsoft email, and will > surely fool many thousands of users. > > :-) isn't technology wonderful! > Very strange thing. I just received 2 email messages purportedly from > Microsoft. > > The first is from "Microsoft Internet Delivery System" > <mailerengine at netmail.com> with the subject line "Bug Notice". It > contains no text except an attachment, "hpqz.scr (104 KB)". > > The second is from "Microsoft Technical Assistance" with no email > address, to "Consumer" <consumer.kiezoane at updates.msn.com>, subject > line "Patch", with 3 attachments. It looks very official with Microsoft > logos all over it and links that look like they should take you to the > MS website. > > Don't worry, I'm not going to do anything stupid like click anywhere on > either message. I do not use ANY Microsoft products, and Microsoft > would have no reason to have my email address. I'm pretty convinced > these are the worst kind of spam, with viruses or Trojan horses or > worms or some other malevolent ware lurking under the surface. > > It is puzzling, though, that both AppleMail and Earthlink let these > slip through the spam filters. Or am I a jaded, over-spammed, > suspicious cynic? > > Alex Whitman > Louisville > > > > | The next meeting of the Louisville Computer Society will > | be September 23. The LCS Web page is <http://www.kymac.org>. > | This list's page is <http://erdos.math.louisville.edu/macgroup>. > -- Thanks! Beth -------------- next part -------------- An HTML attachment was scrubbed... URL: http://www.math.louisville.edu/pipermail/macgroup/attachments/20030918/d6274461/attachment.html
