Re: [cobalt-users] LIST POLICE TAKE NOTICE <Off Topic>Virus(spam)</Off Topic>

["Kevin D" <kdlists@xxxxxxxxxxxxxxx>]

Yeah, I've been getting these too, and the Cobalt lists are the only things
I subscribe to.

I did some checking on the spam's I've been receiving from this email
address. It appears that the mail headers are forged, and that each piece of
spam originates from seemingly a different IP address. So, I looked up the
message ID in the header and searched my mail log and viola... the spam was
relayed to my server from 148.233.138.198 (customer138-198.telmex.net.mx).
Can anyone else confirm this finding, or could this log entry be forged as
well?

Thanks,
Kevin

----- Original Message -----
From: <webmaster@xxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Monday, December 11, 2000 4:33 PM
Subject: RE: [cobalt-users] <Off Topic>Virus(spam)</Off Topic>


> Yeah, I've been getting hard by that spammer and have been thinking
> about also posting a question on how to block the spam. These are the
> headers.  Any clues?
>
>
> Howard Sacks
> webmaster@xxxxxxxxxxxx
>
>
> Return-Path: <>
> Received: from l3q5m8 ([200.250.43.241])
> by www.musicnn.com (8.9.3/8.9.3) with SMTP id RAA25580
> for <webmaster@xxxxxxxxxxxxx>; Wed, 29 Nov 2000 17:47:08 -0400
> Date: Wed, 29 Nov 2000 17:47:08 -0400
> Message-Id: <200011292147.RAA25580@xxxxxxxxxxxxxxx>
> From: Hahaha <hahaha@xxxxxxxxxxx>
> Subject: Branca de Neve pornÙ!
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
boundary="--VEE7W5IR4HUZODUBS12FC1EN01QZSXMZCL"
>
> Faltava apenas um dia para o seu aniversario de 18 anos. Branca de Neve
estava
> muito feliz e ansiosa, porque os 7 anzes prometeram uma *grande* surpresa.
> As cinco horas, os anzezinhos voltaram do trabalho. Mas algo nao estava
> bem... Os sete anzezinhos tinham um estranho brilho no olhar...
>
>
> Content-Type: application/octet-stream; name="dunga.scr"
> Content-Disposition: attachment; filename="dunga.scr"
>
>
> >  > Anybody else receive an email that contained a virus from
> >>  hahaha@xxxxxxxxxxxx I don't receive any other email on this account
> >>  except from the Cobalt groups. The virus was the TROJ_HYBRIS.D virus
in
> >>  a file called dwarf4you.exe.
> >>
> >>  Thanks,
> >>  Curtis
> >>
> >
> >Yes, I got an email with that file, but I **NEVER** run any
> >executable sent via email so I have no idea weather it contained the
> >virus or not.
> >
> >JC Jones  :)
> >
> >_______________________________________________
> >cobalt-users mailing list
> >cobalt-users@xxxxxxxxxxxxxxx
> >To Subscribe or Unsubscribe, please go to:
> >http://list.cobalt.com/mailman/listinfo/cobalt-users
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>