i received 2 e-mails with application/octet-stream
attachments which i can only associate with
this list:
Dec 11
Subject: A list to MARC
From: mvaterlaus <[EMAIL PROTECTED]>
(hijacked sender account? - contains 'marc.theaimsgroup[1].bat')
Dec 12
Subject: CELLPADDING
From: i89157
(contains a .PIF file ...)
These appear to be virus-spreading emails which
want to launch encoded applications ...
(no, virginia, it's ain't music)
has anyone else received this mail?
does MARC do elaborate virus/intruder screening?
is it at all possible that this is a mailinglist booboo?
my guess is that this is an off-list intruder
but - if anyone is interested - these are the mail
headers:
Return-Path: <[EMAIL PROTECTED]>
Received: from imfep06.kcom.ne.jp (imfep06.kcom.ne.jp [210.174.120.157])
by
---- my isp lines deleted here -------
Received: from Gxbyqah ([210.236.131.102]) by imfep02.kcom.ne.jp
(InterMail vM.4.01.03.23 201-229-121-123-20010418) with SMTP
id <[EMAIL PROTECTED]>
for
---- my isp lines deleted here -------
From: mvaterlaus <[EMAIL PROTECTED]>
To:
---- my isp lines deleted here -------
Subject: A list to MARC
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=XHump6XwIiczhJ4KhRf9bW
Message-Id: <[EMAIL PROTECTED]>
Date: Wed, 11 Dec 2002 11:07:49 +0900
Status:
--XHump6XwIiczhJ4KhRf9bW
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable
...the CELLPADDING e-mail has similar header:
Return-Path: <[EMAIL PROTECTED]>
Received: from imfep01.kcom.ne.jp (imfep01.kcom.ne.jp [210.174.120.145])
by
---- my isp lines deleted here -------
Received: from Somqyklp ([210.236.131.40]) by imfep05.kcom.ne.jp
(InterMail vM.4.01.03.23 201-229-121-123-20010418) with SMTP
id <[EMAIL PROTECTED]>
for
---- my isp lines deleted here -------
From: i89157 <[EMAIL PROTECTED]>
To:
---- my isp lines deleted here -------
Subject: CELLPADDING
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Sj2W8yQF6iGp45WoSwO1HEAsB32iYL893
Message-Id: <[EMAIL PROTECTED]>
Date: Thu, 12 Dec 2002 11:02:04 +0900
Parts/Attachments:
1 OK ~4 lines Text
2 OK 89 KB Audio
3 Shown 0 lines Text
4 2.1 KB Application
----------------------------------------
FRIENDLY NOTE:
i hope everyone on this list is already aware
that e-mail viruses are primarily spread by
a mail recipient voluntarily executing code or
following instructions mailed from the sender.
also, if you run your own mail server, pls try to
make sure your relaying rules are strict...
(imagine my surprise a few years ago when my
neglected PAIR Network e-mail domain had been
hijacked for porn)
if i am the only who received this stuff, or if this
was an honest mistake by (???), i apologize
to have cross-posted this e-mail and wasted your
time.
if not, i hope that the problem stops here.
forewarned is forearmed. perhaps there is a
mighty & able abuse-master interested in investigating...?
j
