[Dshield] return of mail not sent

Doug doug at dwhite.ws
Wed Oct 30 14:07:26 GMT 2002


Klez virus infected email, spoofing you as sender.  notice the attachment xx.jpg.bat - meaning it is
a windows executable.  Thank your stars you are on Linux!



================================
This address is filtered through the open relay database at http://www.ordb.org
and is virus scanned by ANTIVIR
http://www.dwhite.ws
mailto:doug at dwhite.ws
================================
----- Original Message -----
From: "melvin smith" <Foxtail at emailaccount.com>
To: <list at dshield.org>
Sent: Wednesday, October 30, 2002 12:19 AM
Subject: [Dshield] return of mail not sent


| A day or two ago I put togather an old
| 133 MHz machine with a 2GB HDD and went
| on the internet. No firewall, no nuthin.
| Easy to reformat to shake the adbots out
| of it. Today I check the email and find
| a return to sender message for an email
| I never sent, complete with attachment.
| So it hit show full header.
| Heres what it shows, I never heard of this
| entity before.Subject:
|
| Undelivered Mail Returned to Sender -pc
| To:   foxtail at emailaccount.com
| From:   Mail Delivery System <MAILER-DAEMON at emailaccount.com>
| Received:   from rs03.singnet.com.sg (rs03.singnet.com.sg [165.21.101.93])
| by imta07.mta.everyone.net (Postfix) with ESMTP id 8CA388A0A2
| for <foxtail at emailaccount.com>; Tue, 29 Oct 2002 14:52:56 -0800 (PST)
|
|
|
|
| Received:   from rs03.singnet.com.sg (93.16-136-217.adsl.skynet.be [217.136.16.93])
| by rs03.singnet.com.sg (8.12.6/8.12.6) with SMTP id g9TMqnc3007459
| for <foxtail at emailaccount.com>; Wed, 30 Oct 2002 06:52:51 +0800
|
|
|
|
| Content-Type:   multipart/mixed;
| boundary=uvovlel
|
|
|
|
| Mime-Version:   1.0
|
|
|
|
| Date:   Tue,29 Oct 2002 22:52:45 PM
|
|
|
| Message-Id:   <200210292252.g9TMqnc3007459 at rs03.singnet.com.sg>
|
|
|
|
| X-Mailer:   Microsoft Outlook Express 5.50.4133.2400
|
|
|
|
|
|
| Part: 1
|
| This message was created automatically by mail delivery software (Exim).
|
| A message that you sent could not be delivered to one or more of its recipients.
| This is a permanent error. The following address(es) failed:%20technique at cermia.be
|
| For further assistance, please contact < postmaster at emailaccount.com >
| If you do so, please include this problem report. You can
| delete your own text from the message returned below.
|
| Copy of your message, including all the headers is attached
|
| --------------------------------------------------------------------------------
|
| Part: 2
|
| >From  : <foxtail at emailaccount.com>
| To  : %20technique at cermia.be
| Date  : Tue,29 Oct 2002 22:52:45 PM
| Subject  : pc
|
| --------------------------------------------------------------------------------
|
| Part: 2.2
|
| Attached File: pc.jpg.bat Download
|
| prix interessants __________________ http://www.pccorner.be/html/menu.htm
http://www.codima.be/ http://www.cybernoia.be/ http://www.tones.be/shop/prijslijst.php?curr=euro
|
|
|
|
|
| _____________________________________________________________
| A free email account your friends will never forget!
| Get YOURNAME at EmailAccount.com  at http://www.emailaccount.com/
|
| _____________________________________________________________
| Select your own custom email address for FREE! Get you at yourchoice.com w/No Ads, 6MB, POP & more!
http://www.everyone.net/selectmail?campaign=tag
|
| _______________________________________________
| Dshield mailing list
| Dshield at dshield.org
| To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
|




More information about the list mailing list