[Modus] I wonder...

[John M. Troher]

That’s MyDoom.A can tell by the text in the body. No doubt   John   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Cary Fitch Sent: Tuesday, February 10, 2004 2:18 PM To: [EMAIL PROTECTED] Subject: [Modus] I wonder...   I just got this, which 66.226.66.69 which is an A+Net (aka Rodopi) address block.  However I don't expect anything in particular from there, and have no idea who/what "raceface.com" might be.  The size of the file "doc.zip" is 23.3k.   And I am highly suspicous of any zips of binaries, that I am not expecting, Virus Scanning or no.   Anyone have any thoughts on this?   Cary Fitch     Return-path: <[EMAIL PROTECTED]> Received: from raceface.com (unverified [66.226.66.69]) by ann.THE-I.NET  (Vircom SMTPRS 3.0.282) with ESMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>;  Tue, 10 Feb 2004 13:04:31 -0600 Message-ID: <[EMAIL PROTECTED]> From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: MAIL DELIVERY SYSTEM Date: Tue, 10 Feb 2004 11:04:30 -0800 MIME-Version: 1.0 Content-Type: multipart/mixed;  boundary="----=_NextPart_000_0011_C70E8C4B.547C280A" X-Priority: 3 X-MSMail-Priority: Normal   This is a multi-part message in MIME format.   ------=_NextPart_000_0011_C70E8C4B.547C280A Content-Type: text/plain;  charset="Windows-1252" Content-Transfer-Encoding: 7bit   The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.   ------=_NextPart_000_0011_C70E8C4B.547C280A Content-Type: application/octet-stream;  name="doc.zip" Content-Transfer-Encoding: base64 Content-Disposition: attachment;  filename="doc.zip"     Attend Peering Conference for ISP's, April 23-24, 2004, Dallas Texas Full info: http://www.peercon.org