[Dshield] returned mail not sent

Russell Washington russ.washington at vaultsentry.com
Wed Oct 30 20:02:47 GMT 2002

Are you running WINE by any chance?  I saw a writeup somewhere... Slashdot I
think... A couple of weeks back detailing Klez infection within WINE,
propagating using the Linux instance of sendmail listening on

-----Original Message-----
From: melvin smith [mailto:Foxtail at emailaccount.com] 
Sent: Wednesday, October 30, 2002 11:13 AM
To: list at dshield.org
Subject: [Dshield] returned mail not sent

Part: 3.4

>From  : "Doug" <doug at dwhite.ws>
To  : <list at dshield.org>  
Date  : Wed, 30 Oct 2002 08:07:26 -0600  
Subject  : Re: [Dshield] return of mail not sent  

Klez virus infected email, spoofing you as sender.  notice the attachment
xx.jpg.bat - meaning it is a windows executable.  Thank your stars you are
on Linux! Doug.
But Doug, I am on a windows machine, Not Linux, 
what happened to me??? Thanks.

This address is filtered through the open relay database at
http://www.ordb.org and is virus scanned by ANTIVIR http://www.dwhite.ws
mailto:doug at dwhite.ws ================================
----- Original Message -----
From: "melvin smith" <Foxtail at emailaccount.com>
To: <list at dshield.org>
Sent: Wednesday, October 30, 2002 12:19 AM
Subject: [Dshield] return of mail not sent

| A day or two ago I put togather an old
| 133 MHz machine with a 2GB HDD and went
| on the internet. No firewall, no nuthin.
| Easy to reformat to shake the adbots out
| of it. Today I check the email and find
| a return to sender message for an email
| I never sent, complete with attachment.
| So it hit show full header.
| Heres what it shows, I never heard of this
| entity before.Subject:
| Undelivered Mail Returned to Sender -pc
| To:   foxtail at emailaccount.com
| From:   Mail Delivery System <MAILER-DAEMON at emailaccount.com>
| Received:   from rs03.singnet.com.sg (rs03.singnet.com.sg [])
| by imta07.mta.everyone.net (Postfix) with ESMTP id 8CA388A0A2 for 
| <foxtail at emailaccount.com>; Tue, 29 Oct 2002 14:52:56 -0800 (PST)
| Received:   from rs03.singnet.com.sg (93.16-136-217.adsl.skynet.be
| by rs03.singnet.com.sg (8.12.6/8.12.6) with SMTP id g9TMqnc3007459 for 
| <foxtail at emailaccount.com>; Wed, 30 Oct 2002 06:52:51 +0800

A free email account your friends will never forget!
Get YOURNAME at EmailAccount.com  at http://www.emailaccount.com/

Select your own custom email address for FREE! Get you at yourchoice.com w/No
Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag

Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:

More information about the list mailing list