[Dshield] Mail Header from Virus

Joe MacDonald joe at deserted.net
Thu Sep 25 14:03:47 GMT 2003


For anyone who is interested, there has been a veritable deluge of these
finding their way into my inbox over the last two weeks, all from
different sources, most with slightly different text in the bodies, but
all containing the same ~140k executable (the executable, of course,
always has a different mime-type and a different name).

Here are the headers from the two most recent of these messages.

-Joe.

> ------------------------------------------------------------------------
> From ian.douglas40 at ntlworld.com  Thu Sep 25 09:56:51 2003
> Return-Path: <ian.douglas40 at ntlworld.com>
> Received: from mta05-svc.ntlworld.com (mta05-svc.ntlworld.com
> [62.253.162.45])
>         by hal.Deserted.NET (8.12.8/8.12.8) with ESMTP id h8PDtpYa011970
>         for <joe at deserted.net>; Thu, 25 Sep 2003 09:55:53 -0400
> Received: from mznkd ([80.3.176.53]) by mta05-svc.ntlworld.com
>           (InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
>           id <20030925135239.CDXN1712.mta05-svc.ntlworld.com at mznkd>;
>           Thu, 25 Sep 2003 14:52:39 +0100
> FROM: "network mail delivery service" <mailservice at netmail.com>
> TO: "Inet Client" <client at yourserver.com>
> SUBJECT:
> Mime-Version: 1.0
> Content-Type: multipart/alternative;
>         boundary="slsxiiuvv"
> Message-Id: <20030925135239.CDXN1712.mta05-svc.ntlworld.com at mznkd>
> Date: Thu, 25 Sep 2003 14:52:54 +0100
> ------------------------------------------------------------------------
>
> From ian.douglas40 at ntlworld.com  Thu Sep 25 09:39:21 2003
> Return-Path: <ian.douglas40 at ntlworld.com>
> Received: from mta03-svc.ntlworld.com (mta03-svc.ntlworld.com
> [62.253.162.43])
>         by hal.Deserted.NET (8.12.8/8.12.8) with ESMTP id h8PDckYa011855
>         for <joe at deserted.net>; Thu, 25 Sep 2003 09:38:52 -0400
> Received: from felqx ([80.3.176.53]) by mta03-svc.ntlworld.com
>           (InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
>           id <20030925133808.CUYP29289.mta03-svc.ntlworld.com at felqx>;
>           Thu, 25 Sep 2003 14:38:08 +0100
> FROM: "MS Corporation Customer Bulletin"
> <hxaxflxhvyjuq at confidence.ms.com>
> TO: "Consumer" <ezkhyn.ceagfqms at confidence.ms.com>
> SUBJECT: Newest Internet Update
> Mime-Version: 1.0
> Content-Type: multipart/mixed; boundary="xisjmlvy"
> Message-Id: <20030925133808.CUYP29289.mta03-svc.ntlworld.com at felqx>
> Date: Thu, 25 Sep 2003 14:38:29 +0100
> ------------------------------------------------------------------------

--
Joe MacDonald
:wq




More information about the list mailing list