it's that klez thing. the same headers appear in emails directly to me (and
probably other list members) which purport to have a file attachment that is
a cure for the w32/elkhorn virus but actually IS the klez virus. that
message and your message appeared to have come out of russia but that may
also be spoofed. here are the significant headers:
-----------------------------
Received: from mx9.mail.ru (mx9.mail.ru [194.67.57.19])
by contesting.com (8.12.2/8.12.2) with ESMTP id g4C2MK9F020729
for <tentec@contesting.com>; Sat, 11 May 2002 22:22:21 -0400
Received: from [205.217.16.236] (helo=Idwjodw)
by mx9.mail.ru with smtp (Exim SMTP.9)
id 176jBG-000Duz-00
for tentec@contesting.com; Sun, 12 May 2002 06:33:52 +0400
From: n4lq <n4lq@iglou.com>
To: tentec@contesting.com
-----------------------------
----- Original Message -----
From: "Steve Ellington" <n4lq@iglou.com>
To: "Tentec (E-mail)" <tentec@contesting.com>
Sent: Sunday, May 12, 2002 10:49 AM
Subject: [TenTec] weird postings virus?
> Guys. I have no idea what these strange postings are......
>
> --- StripMime Report -- processed MIME parts ---
> multipart/alternative
> text/html
>
> My outbox shows no outgoing mail to the list at that time and I've scanned
> my drive using the latest Norton's update. I've seen this from other list
> members and now myself (or it appears to be myself).
>
>
>
>
>
> Steve Ellington N4LQ.
>
> _______________________________________________
> TenTec mailing list
> TenTec@contesting.com
> http://lists.contesting.com/mailman/listinfo/tentec
>
|