[no subject]

Robert Reese wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Well, this is a new one...  obviously the worm picks up the domain and
>auto-populates the fields.  A little clever.
>
>Now, it looks like the headers at least show the machine responsible for
>sending or relaying the virus:
>"Received: from vader (CPE-65-28-169-147.neb.rr.com [65.28.169.147])	by
>hydra.host4u.net (8.11.6/8.11.6) with SMTP id i23GDuj25569	for <(my email)>;
>Wed, 3 "
>I scanned the IP and found a number of ports responding, which are the usual
>suspects:
>065.028.169.147  21 25 53 80 110
>
>It appears that the IP resides in Nebraska.
>
>Below is the text of the worm's email, which I believe is the Beagle worm,
>variant E.
>
>Cheers,
>Robert~
>
>*********** BEGIN FORWARDED MESSAGE  ***********
>
>On 3/3/2004 at 10:13 AM noreply at sixit.com <noreply at sixit.com> wrote:
>
>  
>
>>Hello user of Sixit.com e-mail server,
>>
>>Our main  mailing server will be temporary unavaible for next two days, 
>>to  continue receiving  mail in  these days you  have to  configure our
>>free
>>auto-forwarding  service.
>>
>>For details see the attach.
>>
>>Have a good day,
&gt;&gt;  The Sixit.com  team                              <a  rel="nofollow" href="http://www.sixit.com";>http://www.sixit.com</a>
&gt;&gt;
&gt;&gt;
&gt;&gt;    
&gt;&gt;
&gt;
&gt;*********** END FORWARDED MESSAGE  ***********
&gt;
&gt;-----BEGIN PGP SIGNATURE-----
&gt;Version: PGP 8.0.3
&gt;Comment: No on has the right to NOT be offended!
&gt;
&gt;iQA/AwUBQEaCdrw8BOWncaQMEQIkhQCgoiURw88JauQqkvvHdP6VhzdMr90AoItl
&gt;O4+5j2I43EAHmoei0Bzxe9wt
&gt;=6rTM
&gt;-----END PGP SIGNATURE-----
&gt;
&gt;
&gt;Type: DH/DSS 4096/1024 AES-256
&gt;Key ID: 0xA771A40C
&gt;Fingerprint: CAE2 81CA A7CD 6681 341C  E3A9 BC3C 04E5 A771 A40C
&gt;
&gt;
&gt;_______________________________________________
&gt;Ale mailing list
&gt;Ale at ale.org
&gt;<a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt;
&gt;  
&gt;


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00072" href="msg00072.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
<ul><li><em>From:</em> ale at sixit.com (Robert Reese)</li></ul></li>
<li><strong><a name="00075" href="msg00075.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
<ul><li><em>From:</em> esoteric at 3times25.net (Geoffrey)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00067" href="msg00067.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
<ul><li><em>From:</em> ale at sixit.com (Robert Reese)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00070.html">[ale] www.sco.com</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00072.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00067.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00072.html">[ale] WORM! Fwd: Warning about your e-mail account.</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00071"><strong>Date</strong></a></li>
<li><a href="threads.html#00071"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>