[no subject]

Well, this is a new one...  obviously the worm picks up the domain and
auto-populates the fields.  A little clever.

Now, it looks like the headers at least show the machine responsible for
sending or relaying the virus:
"Received: from vader (CPE-65-28-169-147.neb.rr.com [65.28.169.147])	by
hydra.host4u.net (8.11.6/8.11.6) with SMTP id i23GDuj25569	for <(my email)>;
Wed, 3 "
I scanned the IP and found a number of ports responding, which are the usual
suspects:
065.028.169.147  21 25 53 80 110

It appears that the IP resides in Nebraska.

Below is the text of the worm's email, which I believe is the Beagle worm,
variant E.

Cheers,
Robert~

*********** BEGIN FORWARDED MESSAGE  ***********

On 3/3/2004 at 10:13 AM noreply at sixit.com <noreply at sixit.com> wrote:

>Hello user of Sixit.com e-mail server,
>
>Our main  mailing server will be temporary unavaible for next two days, 
>to  continue receiving  mail in  these days you  have to  configure our
>free
>auto-forwarding  service.
>
>For details see the attach.
>
>Have a good day,
&gt;   The Sixit.com  team                              <a  rel="nofollow" href="http://www.sixit.com";>http://www.sixit.com</a>
&gt;
&gt;

*********** END FORWARDED MESSAGE  ***********

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3
Comment: No on has the right to NOT be offended!

iQA/AwUBQEaCdrw8BOWncaQMEQIkhQCgoiURw88JauQqkvvHdP6VhzdMr90AoItl
O4+5j2I43EAHmoei0Bzxe9wt
=6rTM
-----END PGP SIGNATURE-----


Type: DH/DSS 4096/1024 AES-256
Key ID: 0xA771A40C
Fingerprint: CAE2 81CA A7CD 6681 341C  E3A9 BC3C 04E5 A771 A40C



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00071" href="msg00071.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
<ul><li><em>From:</em> jeb at rev-x.com (jeb)</li></ul></li>
<li><strong><a name="00074" href="msg00074.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
<ul><li><em>From:</em> esoteric at 3times25.net (Geoffrey)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00066.html">[ale] [OT] E-Voting -- SB500 Hearing THURSDAY</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00073.html">[ale] OT: One time use Digital cameras</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00066.html">[ale] [OT] E-Voting -- SB500 Hearing THURSDAY</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00071.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00067"><strong>Date</strong></a></li>
<li><a href="threads.html#00067"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>