[Dshield] returned mail not sent
russ.washington at vaultsentry.com
Wed Oct 30 20:02:47 GMT 2002
Are you running WINE by any chance? I saw a writeup somewhere... Slashdot I
think... A couple of weeks back detailing Klez infection within WINE,
propagating using the Linux instance of sendmail listening on 127.0.0.1.
From: melvin smith [mailto:Foxtail at emailaccount.com]
Sent: Wednesday, October 30, 2002 11:13 AM
To: list at dshield.org
Subject: [Dshield] returned mail not sent
>From : "Doug" <doug at dwhite.ws>
To : <list at dshield.org>
Date : Wed, 30 Oct 2002 08:07:26 -0600
Subject : Re: [Dshield] return of mail not sent
Klez virus infected email, spoofing you as sender. notice the attachment
xx.jpg.bat - meaning it is a windows executable. Thank your stars you are
on Linux! Doug.
But Doug, I am on a windows machine, Not Linux,
what happened to me??? Thanks.
This address is filtered through the open relay database at
http://www.ordb.org and is virus scanned by ANTIVIR http://www.dwhite.ws
mailto:doug at dwhite.ws ================================
----- Original Message -----
From: "melvin smith" <Foxtail at emailaccount.com>
To: <list at dshield.org>
Sent: Wednesday, October 30, 2002 12:19 AM
Subject: [Dshield] return of mail not sent
| A day or two ago I put togather an old
| 133 MHz machine with a 2GB HDD and went
| on the internet. No firewall, no nuthin.
| Easy to reformat to shake the adbots out
| of it. Today I check the email and find
| a return to sender message for an email
| I never sent, complete with attachment.
| So it hit show full header.
| Heres what it shows, I never heard of this
| entity before.Subject:
| Undelivered Mail Returned to Sender -pc
| To: foxtail at emailaccount.com
| From: Mail Delivery System <MAILER-DAEMON at emailaccount.com>
| Received: from rs03.singnet.com.sg (rs03.singnet.com.sg [22.214.171.124])
| by imta07.mta.everyone.net (Postfix) with ESMTP id 8CA388A0A2 for
| <foxtail at emailaccount.com>; Tue, 29 Oct 2002 14:52:56 -0800 (PST)
| Received: from rs03.singnet.com.sg (93.16-136-217.adsl.skynet.be
| by rs03.singnet.com.sg (8.12.6/8.12.6) with SMTP id g9TMqnc3007459 for
| <foxtail at emailaccount.com>; Wed, 30 Oct 2002 06:52:51 +0800
A free email account your friends will never forget!
Get YOURNAME at EmailAccount.com at http://www.emailaccount.com/
Select your own custom email address for FREE! Get you at yourchoice.com w/No
Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:
More information about the list